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QUANTIFICATION OF OPERATIONAL RISKS 

[0001] This application claims priority under 35 U.S.C. § 1 19(e) to 
provisional application number 60/435,892 by Schaf et al. and entitled 
Quantification of Operational Risks Method And System, filed December 20, 
2002, which is hereby incorporated by reference herein. 

BACKGROUND 

[0002] Concept for the Quantification of Operational Risks 

[0003] 1 . Operational risk measurement - Introduction and Summary 
[0004] Just recently operational risks gained considerable attention as huge losses 
occurred in the banking industry due to such risks. There is no natural definition of 
operational risks, and so different definitions are used in practice. The Basel Committee 
on banking supervision defines in its recent publication operational risks as the risk of 
loss from inadequate or failed internal processes, people and systems or from external 
events. It is also the definition used herein. See Basel Committee on Banking 
Supervision, Working Paper on the Regulatory Treatment of Operational Risk 
(September 2001). 

[0005] For the purpose of this section, operational risk measurement is referred to as 
the quantification of the risk in terms of economic or regulatory capital. For operational 
risks, other forms of quantification (like rating systems or scorings) are appropriate as 
well. These are not discussed here. The quantification of the operational risks are further 
referred to herein in terms of the Basel II AMAs, i.e. the Internal Measurement Approach, 
the Loss Distribution Approach and the Scorecard Approach. One should not expect 
substantial measurement efforts (in the definition of this section) for the Basic and 
Standardised Approach and thus these are not discussed here. 

[0006] At the heart of operational risk measurement is the collection of loss data - the 
collected data should in a minimum consist of the loss or potential loss amount, the 
corresponding business activity, i.e. the reference to the process/service model and the 
loss event date. The loss data collection must be supplemented with rating, indicator, or 
scoring data in order to model the Basel II Scorecard Approach. 

[0007] To enable usage of the risk measurement result in the business management 
processes and thus well-founded management decisions, it is necessary to allow 
separate analysis for internal business lines and - ideally - processes, business units 
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and possibly other organizational units (all per loss type). As a regulatory minimal AMA 
requirement, a bank has to model regulatory capital per business line and loss type (a 
matrix of 56 nodes). A more-dimensional matrix that combines internal and regulatory 
views, would be optimal for a bank. But, such a matrix (the matrix may also be referred to 
as the aggregation tree, which results when mapping the more-dimensional matrix to an 
aggregation tree) would be of extreme granularity and would contain several hundred 
nodes to model. All modeling must take place on the lowest node level and then be 
aggregated. The ideal modeling process would thus be 1 . model up to a thousand 
modeling nodes, 2. aggregate for internal purposes and report and 3. aggregate for 
Basel purposes using a different aggregation dimension. One cannot expect to have 
sufficient loss data for such an ideal process. So, the first and most important modeling 
requirement is the definition of pre-aggregations of data to be modeled, i.e. determine the 
node structure of the more-dimensional matrix. In doing so, the user must be aware of 
the fact that by doing so, one might have to give up expectations that internal and 
regulatory capital results will be the same. 

[0008] The measurement methodologies for operational risk include 
statistical/actuarial methods as well as econometrical techniques. The difficulty in 
measuring operational loss is the large variety of possible loss amounts - ranging from 
high frequency/low severity losses to low frequency/high severity losses. The latter type 
of events is rarely observed but of extreme importance for the modeling process. 
[0009] A bank can distinguish between expected losses (covered by net profit), 
unexpected losses (covered by risk capital) and stress losses (requires core capital and 
hedging). The fact that the extreme stress losses are the really dangerous loss events for 
a financial institution emphasizes once more the necessity for a high-quality loss data 
collection to ensure valid risk modeling, and thus appropriate operational risk charges. 
[0010] In the following, modeling methods for all AMAs are introduced, methods to 
include insurance coverage and use of external data in each AMA model as well as a 
method to optimize the bank-wide insurance portfolio are introduced, and how model 
validation, back-testing, stress testing, and scenario analysis is included in the modeling 
process is described. 

[0011] Although the models described for an exemplary aggregation and node 
structure of loss data may be implemented using either an Excel-Sheet, an Access 
database or other software, and Access database with adequate input and reporting 
functionality is preferred. When referring to these technical solutions, the solutions are 
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referred to herein as 'the tool'. 

[0012] Note on the Advanced Measurement Approaches (AMA) of the Basel II- 
Accord: 

[0013] The Basel Committee has adopted the concept of Advanced Measurement 
Approaches (AMA) for internal assessment of operational risk capital. All approaches are 
rooted in loss data collection and verification of applied methodologies. Otherwise banks 
are relatively free in developing their own approaches as long as these comply with the 
fairly general requirements set out by the Committee. 

[0014] At the moment a number of different approaches has been developed which 
are now in discussion. Despite the flexibility until now, three broad types of AMA have 
emerged: 

• The internal measurement approaches (IMA) 

• The loss distribution approaches (LDA) 

• The scorecard approaches. 

[0015] Banks may also choose to combine these different approaches. The 
committee explicitly stresses the point that there might be further types of AMA. 
[0016] This description discusses the three AMA in detail. This provides a systematic 
comparison of the methodologies and can thus support banks in the decision making 
process for the most suitable approach. It also covers explanations of the explicit or 
implicit assumptions of the models in order to serve as a handbook for a modeling user in 
a bank. The description covers important issues like consideration of insurance and 
inclusion of external data for all three approaches. 

[001 7] The methods described below implicitly answer the requirements set forth 
above. 

BRIEF SUMMARY 

[0018] In one aspect of the invention, a computer-readable medium for storing a 
program is provided for measuring an operational risk of an institution. Accordingly, the 
program directs the computer to execute the steps of inputting multi-dimensional loss 
data, selecting an advanced measurement approach, calculating the advanced 
measurement approach, defining aggregations, calculating a value at risk, and outputting 
the calculated value at risk. The inputting step inputs multi-dimensional loss data in which 
a plurality of analysis nodes are formed by the multi-dimensional loss data and a plurality 
of node inputs are thus provided to correspond to the analysis nodes. The selecting step 
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selects one of a plurality of advanced measurement approaches, including a loss 
distribution approach, a scorecard approach or an internal measurement approach, to 
model the loss data at the analysis nodes so that different of the advanced measurement 
approaches are selectable for different of the analysis nodes. The calculating step 
calculates the advanced measurement approaches so that multiple models of loss data 
can be calculated for each of the analysis nodes. The defining aggregations step defines 
aggregations in which the aggregations are defined by structures that aggregate the 
analysis nodes. The calculating step calculates a value at risk of the aggregations in 
which the calculated value at risk is calculated in response to the advanced 
measurement approaches that are selected for the analysis nodes. The outputting step 
outputs the value of risk. The computer-readable medium may also comprise a defining 
analysis units step. The defining analysis units step defines analysis units so that the 
analysis nodes are aggregated into the analysis units and the node inputs are thus 
provided by analysis unit inputs. The selecting step then selects one of the plurality of 
advanced measurement approaches to model the loss data at the analysis units so that 
different of the advanced measurement approaches are selectable for different of the 
analysis units. The aggregations of the aggregating step are then defined by structures 
that aggregate the analysis units. The calculated value at risk of the calculating step is 
then calculated in response to the advanced measurement approaches that are selected 
for the analysis units. 

[0019] In another aspect of the invention, a computer system is provided for 
measuring an operational risk of an institution. The computer application comprises a first 
means, a second means, a third means, a fourth means, a fifth means and a sixth 
means. The first means loads multi-dimensional loss data in which a plurality of analysis 
nodes are formed by the multi-dimensional loss data and a plurality of node inputs are 
thus provided to correspond to the analysis nodes. The second means calculates a 
plurality of advanced measurement approaches that comprise at least a loss distribution 
approach and a scorecard approach to calculate multiple models of the loss data. The 
third means selects one of the plurality of advanced measurement approaches to model 
the loss data at the analysis nodes so that different of the advanced measurement 
approaches are selectable for different of the analysis nodes. The fourth means defines 
aggregations in which the aggregations are defined by structures that aggregate the 
analysis nodes. The fifth means calculates a value at risk of the aggregations in which 
the calculated value at risk is calculated in response to the advanced measurement 



approaches selected for the analysis nodes. The sixth means defines analysis units so 
that the analysis nodes are aggregated into the analysis units. The third means selects 
one of the plurality of advanced measurement approaches to model the loss data at the 
analysis units so that different of the advanced measurement approaches are selectable 
for different of the analysis units. The aggregations of the fourth means are defined by 
structures that aggregate the analysis units. The calculated value at risk of the fifth 
means is calculated in response to the advanced measurement approaches that are 
selected for the analysis units. 

[0020] In another aspect of the invention, a method that is implemented on a 
microprocessor is provided for quantifying operational risks. The method comprises 
loading loss data, determining an expected event probability, calculating a capital charge, 
calculating the impact of insurance coverage and analyzing the loss data. The loss data 
is loaded for an event type in which the event type is internal fraud, external fraud, 
employment practice, workplace safety, clients, products, business practices, physical 
damage, business disruption and system failure, or execution, delivery, and process 
management. The expected event probability is determined for the event type. The 
capital charge is calculated in response to the expected event probability using an 
advanced measurement approach in which the advanced measurement approach 
includes at least an internal measurement approach, a loss distribution approach, or a 
scorecard approach. The impact of insurance coverage is calculated on the capital 
charge. The loss data is analyzed under at least one scenario. 
[0021] Additional aspects of the invention not summarized here are also described 
and claimed. 

BRIEF DESCRIPTION OF SEVERAL VIEWS OF THE DRAWINGS 
[0022] The invention is illustrated in the drawings, in which: 
Figure 1 is a schematic of a computer system; 

Figure 2 is a flow chart of one embodiment for measuring operational risks; 
Figure 3 is a flow chart of another embodiment for measuring operational risks; 
Figure 4 is a table of advantages and disadvantages; 
Figure 5 is a table of values at risk; 

Figure 6 is a diagram of an approach to the adaptation of scenario and external loss 
data; 

Figure 7 is a graph of rescaling of the loss distribution; 



Figure 8 is a graph of adding of a scenario loss event; 
Figure 9 is an illustration of requirements and methodology; 
Figure 10 is an illustration of basic capital calculations; 

Figure 11 is an illustration of enhanced capital calculations and scaling of external 

data by calculating an event probability; 

Figure 12 is a screen display of the quantification tool; 

Figure 13 is a screen display of the quantification tool; 

Figure 14 is a screen display of the quantification tool; 

Figure 15 is a screen display of the quantification tool; 

Figure 16 is a screen display of the quantification tool; 

Figure 17 is a screen display of the quantification tool; 

Figure 18 is a screen display of the quantification tool; 

Figure 19 is a screen display of the quantification tool; 

Figure 20 is a screen display of the quantification tool; 

Figure 21 is a screen display of the quantification tool; 

Figure 22 is a screen display of the quantification tool; 

Figure 23 is a screen display of the quantification tool; 

Figure 24 is a screen display of the quantification tool; 

Figure 25 is a screen display of the quantification tool; 

Figure 26 is a screen display of the quantification tool; 

Figure 27 is a screen display of the quantification tool; 

Figure 28 is a screen display of the quantification tool; 

Figure 29 is a diagram of an aggregation tree for the quantification tool; 

Figure 30 is a screen display of the quantification tool; 

Figure 31 is a screen display of the quantification tool; 

Figure 32 is a screen display of the quantification tool; 

Figure 33 is a screen display of the quantification tool; 

Figure 34 is a screen display of the quantification tool; 

Figure 35 is a screen display of the quantification tool; 

Figure 36 is a screen display of the quantification tool; 

Figure 37 is a screen display of the quantification tool; 

Figure 38 is a screen display of the quantification tool; 

Figure 39 is a screen display of the quantification tool; 

Figure 40 is a screen display of the quantification tool; 
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Figure 41 is a screen display of the quantification tool; 

Figure 42 is a flow chart of another embodiment for measuring operational risks; 
Figure 43 is a flow chart of an internal measurement approach; 
Figure 44 is a flow chart of a loss distribution approach; and 
Figure 45 is a flow chart of a scorecard approach. 

DETAILED DESCRIPTION 

[0023] With reference to Figure 1 , an exemplary system for implementing the 
invention inciudes a general purpose computing device in the form of a conventional 
computing environment 20, including a processing unit 32, a system memory 22, and 
a system bus 38, that couples various system components including the system 
memory 22 to the processing unit 32. The processing unit 32 may perform 
arithmetic, logic and/or control operations by accessing system memory 22. The 
system memory 22 may store information and/or instructions for use in combination 
with processing unit 32. The system memory 22 may include volatile and non-volatile 
memory, such as random access memory (RAM) 24 and read only memory (ROM) 
30. A basic input/output system (BIOS) containing the basic routines that helps to 
transfer information between elements within the personal computer 20, such as 
during start-up, may be stored in ROM 30. The system bus 38 may be any of several 
types of bus structures including a memory bus or memory controller, a peripheral 
bus, and a local bus using any of a variety of bus architectures. 
[0024] The personal computer 20 may further include a hard disk drive 42 for 
reading from and writing to a hard disk (not shown), and an external disk drive 46 for 
reading from or writing to a removable disk 48. The removable disk may be a 
magnetic disk for a magnetic disk driver or an optical disk such as a CD ROM for an 
optical disk drive. The hard disk drive 42 and external disk drive 46 are connected to 
the system bus 38 by a hard disk drive interface 40 and an external disk drive 
interface 44, respectively. The drives and their associated computer-readable media 
provide nonvolatile storage of computer readable instructions, data structures, 
program modules and other data for the personal computer 20. Although the 
exemplary environment described herein employs a hard disk and an external disk 
48, it should be appreciated by those skilled in the art that other types of computer 
readable media which can store data that is accessible by a computer, such as 
magnetic cassettes, flash memory cards, digital video disks, random access 
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memories, read only memories, and the like, may also be used in the exemplary 
operating environment. 

[0025] A number of program modules may be stored on the hard disk, external 
disk 48, ROM 30 or RAM 22, including an operating system (not shown), one or 
more application programs 26, other program modules (not shown), and program 
data 28. The application programs may include the functionality as detailed in 
Figures 2-3. 

[0026] A user may enter commands and information, as discussed below, into the 
personal computer 20 through input devices such as keyboard 58 and mouse 56. 
Other input devices (not shown) may include a microphone (or other sensors), 
joystick, game pad, scanner, or the like. These and other input devices may be 
connected to the processing unit 32 through a serial port interface 54 that is coupled 
to the system bus, or may be collected by other interfaces, such as a parallel port 
interface 50, game port or a universal serial bus (USB). Further, information may be 
printed using printer 52. The printer 52, and other parallel input/output devices may 
be connected to the processing unit 32 through parallel port interface 50. A monitor 
36 or other type of display device is also connected to the system bus 38 via an 
interface, such as a video input/output 34. In addition to the monitor, computing 
environment 20 may include other peripheral output devices (not shown), such as 
speakers or other audible output. 

[0027] The computing environment 20 may communicate with other electronic 
devices such as a computer, telephone (wired or wireless), personal digital assistant, 
television, or the like. To communicate, the computer environment 20 may operate in 
a networked environment using connections to one or more electronic devices. 
Figure 1 depicts the computer environment networked with remote computer 68. The 
remote computer 48 may be another computing environment such as a server, a 
router, a network PC, a peer device or other common network node, and may 
include many or all of the elements described above relative to the computing 
environment 20. The logical connections depicted in Figure 1 include a local area 
network (LAN) 64 and a wide area network (WAN) 66. Such networking 
environments are commonplace in offices, enterprise-wide computer networks, 
intranets and the Internet. 

[0028] When used in a LAN networking environment, the computing environment 
20 may be connected to the LAN 64 through a network I/O 62. When used in a WAN 
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networking environment, the computing environment 20 may include a modem 60 or 
other means for establishing communications over the WAN 66. The modem 60, 
which may be internal or external to computing environment 20, is connected to the 
system bus 38 via the serial port interface 54. In a networked environment, program 
modules depicted relative to the computing environment 20, or portions thereof, may 
be stored in a remote memory storage device resident on or accessible to remote 
computer 68. It will be appreciated that the network connections shown are 
exemplary and other means of establishing a communications link between the 
electronic devices may be used. 

[0029] Turning to Figure 2, a flow chart of one embodiment for measuring 
operational risks is provided. Accordingly, multi-dimensional loss data is input into a 
computer system as seen in block 70. The loss data may be in the form of either 
internal data, external data or expert prior data. The data may also have as many as 
four dimensions, including business lines, event type, organizational units and 
processes. The business lines may be corporate finance, trading and sales, retail 
banking, commercial banking, payment and settlement, agency services and 
custody, asset management, and retail brokerage. In addition, the event type may be 
internal fraud, external fraud, employment practices and workplace safety, clients 
products and business practices; damage to physical assets, business disruption 
and system failures, and execution delivery and process management. Next, a 
plurality of advanced measurement approaches is provided, and one of the 
advanced measurement approach is selected as seen in block 72. Examples of the 
advanced measurement approaches that may be used include the internal 
measurement approach with and without insurance, the loss distribution approach 
with and without insurance, the scorecard approach on the basis of an internal 
measurement approach with and without insurance using Bayesian transformations, 
and the scorecard approach on the basis of a loss distribution approach with and 
without insurance using Bayesian transformations. Analysis units may also be 
defined as seen in block 76. The computer calculates the advanced measurement 
approaches as seen in block 78. In calculating the advanced measurement 
approaches, a Bayesian updating mechanism may be used as seen in block 74. In 
addition, model back-testing and sensitivity analysis are provided as seen in blocks 
80 and 82. Next, aggregations are defined as seen in block 84. The computer then 
calculates a value at risk in response to the selected advanced measurement 
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approaches as seen in block 86. Finally, the value at risk is output for evaluation as 
seen in block 88. Further details of each step are also described below. 
[0030] Turning to Figure 3, a flow chart of another embodiment for measuring 
operational risks is provided. Accordingly, loss data is loaded into a computer system 
as seen in block 90. The loss data is loaded for event types as seen in block 92. The 
event types may be internal fraud, external fraud, employment practice, workplace 
safety, clients, products, business practices, physical damage, business disruption 
and system failure, and execution, delivery, and process management. Next, an 
expected event probability is determined as seen in block 94. The computer system 
then calculates a capital charge in response to the expected event probability using 
an advanced measurement approach as seen in block 96. The advance 
measurement approach may include an internal measurement approach, a loss 
distribution approach, or a scorecard approach. The computer system then 
calculates the impact of insurance coverage on the capital charge as seen in block 
98. Finally, the loss data is analyzed under different scenarios as seen in block 100. 
Additional steps may also be included as described herein, such as incorporating a 
modeling process using external or scenario lass data. Further details of each step 
are also described below. 

[0031] 2. The modeling process and data requirements 

[0032] When a bank has decided to use an AMA it still has to decide which of the 

following approaches to implement: 

1. the IMA; 

2. theLDA; 

3. the scorecard approach on the basis of the IMA; 

4. the scorecard approach on the basis on the LDA. 

[0033] For a well-founded decision the bank will need to consider: 

• the business case, i.e. capital charge savings; 

• loss data availability; 

• availability of consistent qualitative data (scorecards). 

[0034] In practice banks will use several if not all possible models in order to 
identify the most appropriate one. 

[0035] In this section models and techniques for all four approaches will be 
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described. This includes tests and decision rules to automate the modeling process 
as far as possible. 

[0036] 2.1 . Summary of the modeling process 

[0037] 1 . Design of input data and aggregation structure (one-time effort). 
[0038] The granularity of the model aimed at determines the aggregation structure. 
The aggregation structure is influenced by the modeling dimensions of a bank: internal 
business lines and Basel business lines, organizational structures that are independent 
from business lines and the Basel loss event types. 

[0039] The appropriate structure is achieved by defining the granularity that will 
allow aggregation for all dimensions needed. A trade-off needs to be made because 
the amount of loss data will be insufficient with growing granularity of the aggregation 
structure. It is therefore recommended to design two aggregation trees: one for 
Basel purposes and one for internal capital allocation purposes. The trade-off here is 
that at the highest level of the two trees (the overall bank level) the results will most 
likely differ, which should not be the case in reality. 

[0040] For each elementary node of the aggregation tree (or the two trees) a 
separate sheet will be available for actual modeling. The tool will require internal loss 
data to be imported and assembled in a way that corresponds to the nodes on the 
most elementary level of the aggregation structure(s). 

[0041] 2. External data to supplement the internal data (regular effort) 
[0042] For each node a decision has to be reached whether or not to include external 
loss data. The tool provides tests to support this decision. If external data is necessary it 
will then be included into the tool the same way as the imported internal loss data. 

[0043] 3. The actual modeling process (regular effort) 

[0044] All four AMA are possible models for each node. For efficiency reasons 
the bank should find a good way of combining different models. 

[0045] The IMA 

[0046] If the bank decides to use the IMA it has to fulfill moderate data requirements. 
According to the data structure (see next section) the expected event probabilities and 
the expected losses in the case of an event have to be determined. The basis here are 
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past loss data. Moreover all relevant insurances have to be included into the 
consideration. The capital charge then results by scaling the expected loss by a factor - 
defined by the regulator- that will then render the necessary unexpected loss. 

[0047] The LDA 

[0048] When applying the loss distribution approach (LDA) the level of data 
requirements is significantly higher. Here the bank has to have an extensive 
collection of internal loss data for modeling the frequency and severity distributions. 
Especially for seldom events one will need to augment the loss data by including 
relevant external data (see step 2 above). Having this data, one should perform an 
overdispersion test for the frequency distribution to get a rough idea of the type of 
distribution (Poisson of negative binomial). Moreover for the severity distribution one 
needs to find a threshold u separating low and high severity events. Possible 
insurance cover will affect the loss distributions. These are then used to determine 
the values at risk which in turn form the basis for the operational capital charges. An 
upper bound for the value at risk is obtained using Chebychev's inequality. To obtain 
a better understanding of the tail and to have a sub-additive measure (valuable for 
the aggregation), it is sensible to compute as well the expected shortfall. 

[0049] The scorecard approaches 

[0050] In the scorecard approach one first needs to decide whether an IMA or an 
LDA should be the basis for the scorecard. The next decision - which cannot be 
supported by technical testing means and needs to be made probably only once - is 
on whether a standard statistical regression model shall be applied to model the 
relationship between the qualitative scores and the loss experience of the bank or a 
Bayesian transformation. Both models are described here. Depending on whether an 
IMA or an LDA is to be used, the Bayesian transformation will be for the expected 
loss probability or the loss frequency (and here again for the Poisson and the 
negative binomial cases) respectively. 

[0051] Model testing and sensitivity analysis/Scenarios 

[0052] The important issue of model back-testing (Kupiec test, proportions test) as 
well as stress testing/sensitivity analysis must be performed on a node level as well as 
on the level of the highest aggregation. This is done at the end of the modeling process. 
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[0053] Section 3 covers the mathematics on the first analysis of incoming data, 
section 4 discusses the use of external data and section 5 covers the mathematics 
for all AMA models and technical tests/rules. 

[0054] 2.2. The data structure for the AMA and aggregation in the tool 
[0055] The details of block 70 of Figure 2 and blocks 90, 92 and 94 of Figure 3 
are described here in the following text along with additional descriptions in other 
parts of the text. 

[0056] For the AMA the data has to be collected systematically in order to comply 
with the Basel II requirements and to allow specific allocation of operational risks. 
[0057] The Basel committee prescribes the following coarse structure 
Business Lines: 

• Investment Banking (Corporate Finance, Trading and Sales) 

• Banking (Retail Banking, Commercial Banking, Payment and Settlement, Agency 
Services and Custody) 

• Others (Asset Management, Retail Brokerage) 
Event Type Classification 

• Internal Fraud 

• External Fraud 

• Employment Practices and Workplace Safety 

• Clients, Products and Business Practices 

• Damage to Physical Assets 

• Business Disruption and System Failures 

• Execution, Delivery and Process Management 

[0058] In addition it is sensible to add a further dimension reflecting the internal 
organizational structure. Here a distribution of activities (e.g. IT Services, Back Office) in 
to the various cells will be necessary. 

[0059] Internal risk reporting can differ from Basel reporting. The tool must be able to 
calculate risk measures for any granularity and to aggregate them to higher levels - up to 
a firm-wide measure. This will add at least one other dimension to the aggregation: the 
organizational dimension. All considered, a three-dimensional grid structuring business 
lines, risk-types and organizational units is thus obtained. In addition, a fourth dimension 
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structuring internal processes may be included. 

[0060] It is assumed that the user provides disaggregated data (e.g. for 
organizational units) from a data collection tool. The user has to specify an aggregation 
hierarchy for the quantification in the quantification tool. The quantification tool therefore 
starts with loss series for individual units and respects the aggregation hierarchy in the 
simulation and reporting of losses, either by adding individual risk measures (implicitly 
assuming full correlation) or by individual simulating assuming independence. The tool 
does not build aggregates of individual losses. If the user wishes to calculate a risk 
measure for losses of different units taken together as one series, he has to perform a 
pre-aggregation of the data in the loss collection tool. 

[0061] 3. Data analysis 

[0062] Before starting the modeling process one must ensure that there is an 
appropriate data basis. In this section a few tests are described for the analysis of loss 
data. The next section describes what to do, when the amount of data is insufficient for 
modeling purposes. 

[0063] 3.1. The Q-Q plot 

[0064] Let X x , . . . , X n be a set of iid random variables with ordered statistics 
X < • • • < X t . Moreover let F denote the empirical distribution 

n 

[0065] For a particular estimated parametric distribution F the Quantile-Quantile plot 
(Q-Q plot) is defined as 

[r 



[0066] When this plot is linear, the estimated distribution F fits the sample 
distribution well. This is one way of comparing different estimated distributions and 
selecting the best one. 

[0067] Practically the test for linearity could be performed as follows: 



Define for m <n , Q m := jfjr^.F" 1 ^ - * + :k e {m,...,«}L a partial Q-Q plot. For 



increasing m determine for each Q m a linear regression and determine the distance of 
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the data points from the regression line. As long as this distance is small the fit of the 
parametric distribution is good enough. Growth of the distance shows clearly that a linear 
fit is no longer appropriate, and thus the fit is not good. As a threshold, one could take the 
smallest X k n where this effect can be observed. 

[0068] 3.1 .1 . Q-Q plot for the frequency distribution 

[0069] To find the best fit for the frequency distribution, one may compare the Q-Q 
plots for the Poisson and the negative binomial distributions. Preferably, the distribution 
which shows the best linear behavior is chosen. 

[0070] 3.1 .2. Q-Q plot for the severity distribution 

[0071] Especially for high severity events one will not expect to have ample data 
available. This can again be seen from the Q-Q plot: one would expect such losses to 
have a heavy tail. Thus, if a good fit with only one distribution (in the case of severity this 
would be a lognormal distribution) is seen, one can conclude that there is not enough 
high severity loss data in the collection. For the tail data one should see a clear deviation 
of the linear plot. The threshold can be determined using the partial Q-Q plots Q m 

defined above. 

[0072] 3.2. The mean excess function 

[0073] For the estimated frequency and severity distributions, the mean excess 

function is an indicator for the degree of heaviness of the distribution. 

[0074] Let X be a random variable and let u 0 > 0 be a threshold. The mean excess 

function may now be defined as 

e(u) = E(X - u : X > u 0 ) , for 0 < u < u 0 . 
[0075] The value e(u) is called the mean excess over the threshold u . In order to get 
an idea about the tail behavior of a distribution, one may compare its mean excess 
function with the mean excess function of the lognormal distribution. 
[0076] When the mean excess function of a distribution lies above the lognormal 
mean excess, it is heavy-tailed, thus obtaining a test for the tail distribution. The threshold 
u 0 should be large enough so that one can be certain that it lies in the tail. It can be 
externally defined, and if necessary internally adjusted. One valid idea for the threshold is 
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to derive from external industry data or from the results of the Basel findings on loss 
behavior for the various loss event types and business lines. 

[0077] 4. Including external data 

[0078] When it becomes clear from the data analysis that there is not enough loss 
data for good statistical modeling, one would need to include external loss data. This 
would be of particular importance for seldom events with high severities as those are 
rarely observed. In this case the integration of external loss data will be essential to 
ensure an appropriate data basis for operational risk modeling. 
[0079] For the body of the distribution (the 99.9%-quantile) the exact fit of the 
parametric distribution is of lesser importance as the really dangerous operational risks 
lie in the tail of the loss distribution. But, if there is not enough data for the estimation of 
the body, one would need to include external loss data for this as well. 
[0080] The problem with using external loss data is the question of whether these 
data are meaningful for the specific bank. Moreover it is not at all clear from the 
beginning which data to select for analysis as external data collections have intrinsically a 
certain selection bias. The main challenge here is to collect good data as no 
standardized source exists. 

[0081] In addition the external data can be classified either by reasons or by 
consequences. The first classification criterion is the appropriate one as only such data 
allows one to decide whether the specific loss data is relevant or not. This way one also 
captures "near losses". 

[0082] The suggested procedure for the integration of external loss data is the 
following: 

• Thorough qualitative analysis of external data 

o Can this loss event occur in the particular bank? 

o How likely is this loss event to occur within the particular bank? 

o Include data only if the probability for the loss event is sufficiently high. 

• Scaling of external loss data 

o Which is the best scaling method? Here one needs to consider the size of 
the bank as well as other external conditions (e.g. the legal environment). 

• When including external loss data, always assume that the frequencies of high 
severity losses at all banks are the same. 
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[0083] The inclusion of external data is a manual process, which requires a certain 
degree of expertise. In addition, the process of including external losses in the database 
is an effort that will not have to be repeated for every internal reporting period. Very likely, 
the external data will change incrementally over time by the user removing external 
losses and adding new ones. For external (regulatory) reporting though, it will be 
inevitable to use - and explain, why one uses - the external events chosen for modeling. 

[0084] 4.1 . Expert prior 

[0085] When there is no internal or external data available, one might need to rely on 
an expert prior to start with. Such a prior loss distribution can be obtained as follows: 

• Divide the loss amount scale into significant loss buckets. 

• Interview experts about the number of losses in the respective buckets. 

• Use the obtained loss distribution as a prior distribution in the further analysis. 
[0086] This expert prior needs to be assigned a weighting in order to be able to 
include genuine, i.e. measured, loss data. Let we N be the weight for the expert prior. 
Using a uniform distribution on the value range of losses, one can generate w points 
modeling the prior distribution. Any additional data is subsequently just included in the 
loss data set. 

[0087] 5. The basic structure of the AMA 

[0088] The details of blocks 78, 84 and 86 of Figure 2 and blocks 96 and 98 of 
Figure 3 are described here in the following text along with additional descriptions in 
other parts of the text. 

[0089] For each node in the aggregation structure, it is necessary to have a separate 
loss description, quantification and capital allocation. See, e.g., block 310 of Figure 42. 
The key elements are the frequency and the severity of losses for the respective node. 
There must be also a way to aggregate the capital charges at the node-level to various 
higher levels. 

[0090] 5.1 . The internal measurement approach (IMA) 
[0091] In the IMA the operational risk capital is estimated on the basis of expected 
operational losses. This means that there is assumed a fixed relationship between the 
expected and the unexpected losses (the tail of the density function for the distribution). 
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This relationship might be very subtle and highly complex. 
[0092] The key ingredients for the IMA are: 

PE: the probability of an operational risk event; 

LGE: the loss given the occurrence of an operational risk event; 

El: the exposure indicator capturing the scale of the bank's activities within a 
particular business line. 

[0093] Assuming a linear relationship between expected and unexpected losses, one 
obtains for the required capital charges of a Basel node 

K i} = r iJ xEI i xPE iJ xLGE ij = r 9 xEL 9 , 

where the indexes parameterize the three-grid (the index / stands for the business lines, 
j runs over loss event types). As the expectation values are linear the overall capital 
charge is obtained by summing over all nodes 

K total = ^ K ij ■ 
ij 

[0094] The aggregation to other levels is in this case similarly straight forward. In the 
IMA it is important to have a reliable and valid estimation of the probabilities and loss 
amounts, and to determine the transformation mapping (7. ) correctly. One certainly will 

need to verify that such a mapping exists as this is not at all clear from the beginning. For 
example, for the normal distribution there is no straight forward relationship between 
expected and unexpected losses. But one can find good approximations via a binomial 
distribution with small probabilities p . For a detailed discussion see the last section of 
this section. 

[0095] The factors/., are fixed by the regulators though there might be adjustments if 
the bank demonstrates that it has a loss distribution far from the industry norm. 

[0096] 5.1 .1 . Consideration of insurance 

[0097] Insurances are a tool for mitigating negative consequences from loss events. 
They will not influence the frequency of events, but the severity, i.e. the loss amount, 
only. 

[0098] 5.1 .1 .1 . Applying the binomial distribution model to insurance 

[0099] Let L be the loss amount and R the recovery amount in the case of a loss 

event. Moreover let C be the premium for the insurance policy. Assuming that the 
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occurrence of a loss event is binomially distributed with probability p the expected loss 

over one year would be 

E { year (L) = p(L-R) + C. 

[0100] Thus a fair premium would be C = pR . 

[0101] A fairly priced insurance will not change the expected loss but it will reduce the 
volatility (standard deviation) and thus the/.* -factors. So the bank will have the chance 
to reduce its operational capital charge. 

[0102] 5.1 .1 .2. Extending to the normal distribution model 

[U IUOJ in Qenercll Ull« UclIlMUl CAjJCUl IU HClVC d yuuu iciauun uciwcci i li ic ^Apbv/iuu 

and the unexpected losses. But when one uses the special properties of a distribution it 
might be possible to find such a map, a good example will be discussed here. 
[0104] The normal distribution can be seen as the limit case of the binomial 
distribution just discussed in the previous section. Hence, one can use features of both 
distributions and in this way obtain further insight into the impact of an insurance cover 
on the operational capital charge. 

[0105] In the case of normal distribution there is still no straight-forward relationship 
between the expected and unexpected losses, but the unexpected loss is a multiple of 
the standard deviation: For a 99.9% -confidence level the unexpected loss is 
approximately 3a . 

[0106] The normal distribution N(//,cr 2 ) can be approximated with a binomial 
distribution B(N,p)\N\th LGE= L for large N . For the standard deviation, one then has 

a- = LyjNp{\ - p) « L^Np , when p is small. 
[01 07] Thus, one obtains approximately 

Un exp ected.Loss 99 9% _ 3L^Np 3 
Expected, Loss 999% LNp «jNp 

[0108] This shows that the corresponding y ijk are proportional to -^1= . 

[0109] With the consideration of insurance this means that the standard deviation 
becomes 

* insurance = (L - R)JIfy . 
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[0110] Hence the y ijk in this case are now proportional to 

(L - R)y[Np = (1 _ * Here the quotient — is also called the recovery rate. Here 



LNp L ^Np L 

one sees again that the standard deviation decreases leading to a reduced operational 
capital charge. 

[01 1 1] This is rather an example where one can explicitly find a map from the 
expected to the unexpected loss and how an insurance influences the operational capital 
charge. !n. real life one would not expect to find normally distributed processes. 

[0112] 5.2. The loss distribution approach (LDA) 

[01 13] In the LDA, banks estimate for each node of the three-grid the distribution of 
operational losses over a certain future horizon (for example one year). The capital 
charge is then determined based on a high percentile of the loss distribution (in 
discussion is a 99.9% -level). 

[0114] Typically the loss distribution is derived from individual frequency and severity 
distributions, which are assumed to be independent, i.e. a specific loss event is a random 
draw from the frequency and severity distributions. This way one obtains an operational 
value at risk for each node of the grid. The individual values at risk can then be 
aggregated using different methods. 

[01 15] One way of doing so could be by considering correlations. For the sake of 
simplicity one could restrict oneself to pair-wise correlations only. Even in this situation it 
will not be trivial to determine the necessary factors. Simply summing the operational 
values at risk figures over the respective nodes would overstate the operational risk of 
the bank and would consequently lead to an unnecessary high capital charge. 
[01 1 6] Another way for aggregation is to perform a Monte-Carlo-Simulation. This 
method requires more computational effort (which is by no means an issue) but is 
conceptually significantly easier than the previous method. 

[01 17] In the latter, the description of the frequency and severity distributions follows. 
[01 18] In the LDA it is essential to have enough high-quality loss data. Two 
distributions have to be estimated: the frequency distribution and the severity distribution. 
[01 19] To estimate the frequency distribution for each node the number of loss 
events is counted over a certain period of time (typically one month). 
[0120] For the estimation of the severity distribution node-wise the corresponding 
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loss amounts are collected. 

[0121] 5.2.1 . Testing for overdispersion in the frequency distribution 
[0122] The Poisson model is a restriction of the negative binomial model. Thus, one 
can test for overdispersion using the likelihood ratio test or the Lagrange multiplier test. 
The LR test statistic is 



where L Foisson and L ^ are the values of the likelihood functions for the Poisson and the 
negative binomial model, respectively. Under the null hypothesis of no overdispersion the 
test statistic is distributed chi-squared with one degree of freedom. The Lagrange 
mulipliertest statistic is 



which is standard normal under the null hypothesis of no overdispersion. The LM test 
statistic has the advantage that one only needs to estimate the Poisson model to 
compute it. 

[0123] 5.2.2. The Frequency distribution 

[0124] It is quite common to assume that the frequency of loss events follows a 
Poisson distribution. The probability that the value X of the random variable equals x is 
in this case given by 



For the Poisson distribution the expectation value ju equals the variance. This 



is obviously very special and although widely used in practice one would not expect such 
frequency functions in real life. Thus it seems to be necessary to relax these strong 
assumptions and to consider alternative distributions. 

[0126] A way for more realistic modeling of frequency distributions would be to use 
two parameters. In this context one often uses the negative binomial distribution, a two- 
parameter distribution. This distribution is somehow a generalization of the Poisson 
distribution as the conditional negative binomial distribution is Poisson. The probability for 





P(x) = 
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X = x in the negative binomial case is given by 

P(x) = ^— — p r (\-p) x , wherexeN, r eRand /?e(0,l). 
x!T(r) 

[0127] This implies for the expectation value and the variance 

E(X) = r(l ~ p) respectively Var(X) = r(1 ~ p) . 
P P 

[0128] Setting r = — and p = — - — for parameters K * 0 and ju * -\- , one 

K \ + Kju K 

obtains now 

E(X)=ju and Var(X) = // + £// 2 . 
[0129] The negative binomial distribution allows modeling the expectation value and 
the variance independently, and thus more realistically to the actual situation. The 
parameters are chosen to fulfill a maximum likelihood condition. 
[01 30] One certainly can consider other two-parameter distributions or distributions 
with more parameters, but one always needs to keep in mind that the model should be 
kept as simple as possible in order to make it easy to work with. 

[0131] 5.2.3. The Severity Distribution 

[01 32] The second component on the way of modeling a loss distribution is to 
understand the severity distribution for a given event. It is of crucial importance to find a 
good fit of the tail with the actual distribution as these are the events that put the bank at 
risk. A prerequisite for reliable modeling are sufficiently much, good data. And this is a 
particular problem for high severity events as these are quite rare. 
[0133] To overcome the scarcity of high severity events, internal loss data needs to 
be augmented. Here one could follow these procedures: 

• Generate scenario data by assuming that all mitigation processes would have 
failed, thus obtaining the worst case loss for the particular events; 

• Incorporating suitable external loss data. 

[0134] Classically for the severity distribution often a lognormal distribution is 
assumed. The corresponding density is then given as 
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/(0 = 



ta 



exp - 



(log;- //) 
2a 2 



2 \ 



t>0 



[0135] 



otherwise 

For the corresponding expectation value and the variance, one obtains 



E = exp 



-2\ 



<J 
~2 



and Var = exp(2//+ cr 2 )(exp(cr 2 )-l). 



[01 36] In practice the tail of the lognormal distribution is often not fat enough, i.e. the 
density function decays too fast. But understanding the distributional behaviour of large 
severities is of particular importance to the business as these are the most dangerous 
risks for a business. 

[01 37] So one could try to look at another possible distribution for the severity: the 
two-parameter Weibull distribution, with density function 



f(t) = 



V 



exp(- t>0, 



where p and 7j are positive parameters. 

[01 38] In order to increase the accuracy, it might be worthwhile to introduce a 
threshold and to model the low severities separately from the high severities for which 
one could apply Extreme Value Theory (EVT). 

[01 39] Let w > 0 be the threshold separating the low severity from the high severity 
events. Then one may use the Hill estimator to determine the parameters for the 
generalized Pareto distribution (GPD) for the tail t > u . Its distribution function reads 



1-1 + 



1-exp - 



t — u 



4*0 



4 = 0 



with the positive scale parameter ft . 

[0140] Let the random variables X { ,...,X„ be independent and identically distributed 
(iid). The assumption is that there are k observations larger than u . 
[0141] For the order statistics X k n < X k _ i n < < X l a one may define 
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i = H(\nX in -]nX kn )=:H ktn , 

the average of differences of the k observations in the tail. This defines for the tail the 
distribution function 



F(0 = 1 — 
n 



1 + 



r/t 



, for t > u . 



[0142] One would then be interested in describing the tail of the loss distribution 
nreater than a oredefined threshold. Let now c be the confidence level for the required 
analysis (e.g. c = 99.9% ). Then, the following estimate for the corresponding severity 
quantile is 



SQ c =u + 



X, 



n(l - c) 



-1 



[0143] Thus summarizing, a complete description of the severity distribution is as 
follows: 



F(0 = 



^^log normal C^) ^ 



log normal 



(0 



F(r) 



,t>U 



[0144] In general this function will not be differentiate at m , but this is no problem at 
all. 

[0145] In the composed severity distribution, the body, i.e. the distribution of events 
with low severities, has been slightly distorted. As the example uses an extremely high 
confidence level, this scaling does not have much impact. Nonetheless, one could 
compare this part of the severity distribution with the empirical distribution obtained solely 
on the basis of observed loss data. 

[0146] 5.2.4. The selection of the threshold between HF/LI-events and LF/HI- 
events 

[0147] A description of how to determine the threshold u is now provided. Let 
X x ,...,X n be iid, and let X n n < < X u „ be the corresponding order statistics. 

[0148] For the H k n s consider now the corresponding Hill graph 
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{(k,Hkl ):l£k£n-l}. Hence, this is a graph with the tail parameters belonging to the 
generalized Pareto distribution for the k largest observations. 

[0149] The threshold u can be chosen for the stable area of the Hill graph. In order to 
have many values, u should be as small as possible. In practice this can be done by 
considering a band [h;I - s 9 H~ l n + s\ about the tail parameter for the two largest 
observations. The threshold u will be then chosen as follows 

u := X kQfn , where k 0 := max(k : H;] n e [h~ 1 „ - s, H~ l n + e]}. 
[01 50] Properties of the Hill estimator 

[0151] Assuming individual losses are iid and under some additional conditions the 
Hill estimator is consistent and asymptotically normally distributed with 

4k{a - a) — ^N(o.a 2 ) , where £ = 4 and a = ~^- 

[0152] This allows the construction of an asymptotic confidence interval for the 
Hill estimator in the Hill plot. 

[0153] 5.2.5. Determining the aggregated loss distribution 
[0154] Having discussed how to estimate the distributions for the frequency and for 
the severity it remains to be determined now the distribution for the operational losses. It 
is best obtained by using Monte Carlo simulation: first draw a result from the frequency 
distribution, then draw as many results from the severity distribution as there are losses. 
Finally by summing all the losses one obtains a draw from the corresponding loss 
distribution. In order to generate a loss distribution one needs to perform this drawing 
procedure sufficiently often. This procedure results in the loss distribution for a node. 
[0155] The aggregation of the individual distributions can be performed by computing 
the overall distribution via Monte Carlo simulation and reading off the aggregated VaR. 
For two loss distributions with densities /, and f 2 the aggregated loss distribution has 
the density function 

(/ 1 */ 2 )(0= )Mt-x)f 2 (x)dx. 

0 

[0156] One major problem with the value at risk is that it does not have satisfactory 
sub-additivity properties. Under the dependency assumption of total positive correlation 
one can explicitly derive the value at risk for the aggregated loss distribution. Let L x (t) 
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and L 2 (t) be two distribution functions. Note here that x 2 = • Considering the 

function p.{t) := t + L 2 (L, (/)) , the quantile a is now 

a = Pit, + t 2 < VaR(a)) = E(z Mll) ^ aR(a) ) = L x {^\VaR{a)) 
[01 57] So one has VaR(a) = ^{L\ x (a)) and can obtain thus 

VaR(a) = (a) + U 2 X (Z, (L~ l {a))) = L\ x {a) + Z"' (a) = VaR x {a) + VaR 2 {a) . 
[01 58] For an arbitrary collection of nodes with corresponding values at risk 
VaR x VaR k , one has under the assumption of total positive dependence 

i 

[0159] 5.2.6. Consideration of Insurance in the LDA 

[0160] In case of an insurance that applies for a certain loss type only, the severity of 
that event is affected - not the event frequency. Let s be the density function for a 
severity distribution of a particular loss event. Moreover, one may assume that individual 
losses up to an amount of b are covered by an insurance (each separately). All the other 
severity values are not affected. This leads to a modified severity distribution with density 
function 

s(t)= s (*W-Z{*j>)) where x is the indicator function. 

1^(0(1-^(0.6)) 

[0161] Using this modified severity distribution in the Monte Carlo simulation instead 
of the original gives the loss distribution F\L) with insurance consideration, but still 
without the deduction of the paid insurance premium. By /' , one may denote the 
corresponding density. The premium C has to be paid by the bank in any case, it is 
hence a certain event. The density function for the corresponding distribution (a step 
function) is S c , a delta-distribution. 

[0162] So one has for the loss density with premium consideration 

/(*) = Vc */')(*) = J*c • 

L 

[0163] The loss distribution is then F(L) = jf(x)dx . 

0 

[0164] Alternatively, one can derive a modified loss distribution directly from the 
original loss distribution. Let L > Obe the loss amount, and let F : R >0 — » [o,l] be the loss 
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L 

distribution with the corresponding density function / :R-+R >0 , i.e. F(L) = \f{t)dt . 

0 

Usually an insurance covers loss events up to a certain maximum amount L 0 . A fair 

)tf{t)dt 

premium would be then C = E(L <L 0 ) = . This premium has to be paid in any 

case to obtain in return an insurance cover up to maximum amount of L 0 in the case of a 

loss event. The modified loss distribution is now 

~ fO ,L<C 
F{L) ~[F(L + L Q -C),L>C ' 

[0165] This distribution function applies to the node level. Aggregated loss distribution 
functions are then obtained by simulation. 

[0166] 5.2.7. Optimizing the insurance portfolio 

[0167] In the previous section the impact of insurance cover on the loss distribution of 
a particular node of a bank's operational risk grid was described. What is needed at this 
point is to introduce a procedure for optimizing the portfolio of the different insurance 
policies on the bank-wide level. 

[0168] Let L denote the gross loss, i.e. aggregated loss of a bank with corresponding 
density function f agg :XxR^ 0 R for the loss distribution with insurance consideration, 
where / = (/, , . . . , I m ) is a vector of insurance policies and x = (x lr ..,x m )GlcC 0 the 
corresponding insurance portfolio structure vector. Here the x { represent the amount of 
insurance coverage. The space X is here the parameter space of feasible portfolio 
structures. Define 

V(x,u)= jf agg (x,L)dL, 

the probability for losses not exceeding the threshold u . For e (0,1) let moreover be 

a{x, /3) := min{w e R : ^(x, u) > 0\ , the value at risk for the 0 -quantile. 

[0169] One may introduce now <D(x) := \l ■ f agg (x,L)dL and the J3 -conditional 

value at risk (^-CVaR), — X — ®(x) . 
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[0170] It can be shown that minimization of the function ^-^O(x) can be achieved 

by minimizing the function 

F(x, u) = (1 - /?)u + j(L - u)f agg (x, L)dL over the set X x R^ 0 . 

[01 71 ] Thus, one obtains min F(x, u) = min F(x, a(x, J3)) = min <D(x) . Solving the 

xf=X y u<=R±Q xeX xeX 

minimization problem one finds an optimal portfolio vector 3c and the corresponding /? - 

value at risk a := a(x,/?) , and hence the optima! CVaR is then - 1 — F(x,a) . As 

CVaR > VaR holds one has simultaneously minimized the VaR. 
[0172] In this description one always assumes that the density functions for the 
distributions exist. In cases where the distributions are not differentiate one could apply 
approximations with differentiate functions. 

The computation of the function F(x,u) could be done using nonlinear programming 
techniques. 

[0173] 5.2.8. An upper bound on loss quantiles using Chebychev's inequality 
[0174] If one is willing to assume that the loss distribution has a finite expected value 
and a finite variance, one can derive an upper bound on the quantiles of individual losses 
or losses over a certain time period. 

[01 75] Chebychev's inequality for random variables says that 

F(\X-E(X)\>kc7(X))<j T 

or analogously for lists that 

(fraction of elements in the list that are k or more standard deviations away from 

the mean) < \ . 

k 

[0176] As an example, one may estimate the monthly average of losses as 

1 ,000,000 with a standard deviation of 350,000. If one assumes that the losses between 

the months are independent from each other the expected loss amount over one year is 

12 4,000,000 = 12,000,000 

with a standard deviation 

a/12- 350,000 = 1,212,436. 
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[0177] Since 

PQ X - 12,000,000 |> 31.62 • 1,212,436) < — ^ - 0.001 

3 1 .62 

the probability that the absolute value of the difference between the sample sum of 
losses over one year and 12,000,000 exceeds 31 ,62*1 ,212,436 = 38,340,579 is at most 
0.1 %. A total loss amount of 50,340,579 can thus be considered as an upper bound for 
the 99.9%-quantile over one year. 

rrM 70i con i ;™;+^,+;^,^ ^ \/^d- ^w^^^+^>^i ^u^^-f^ii 
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[0179] Let VaR(99.9%) be the 99.9%-quantile of the loss distribution. The expected 
shortfall is now defined as 

ES(VaR 999% ) := E(L:L> VaR 999% ) . 
[0180] The expected shortfall can be also re-written as 

ES(VaR 999% ) = VaR 999Vo + E(L - VaR 99 9% : L > VaR 99 9% ) . 

[0181] The tail of the loss distribution can be modeled using EVT as described for high 
severity events over a threshold u . The most appropriate distribution in this case is the 
generalized Pareto distribution G^ fi . For the loss distribution one has then 

F u (Z)-G^(Z), with L>u. 

[0182] When taking a higher threshold u , the tail parameter ^ stays the same, but 
one has a different scaling 

F u-( L ) = G ^ + x«'-u)( L ) ■ where L > u' . 
[0183] Taking u' to be the value at risk VaR , one has a nice explicit description of 
the excess distribution if ^ < 1 . The mean of the distribution G^ + ^ (VaR _ u) is 

j3+%(VaR- u) 
W 

is 



, and hence the value of the expected shortfall corresponding to the VaR 



l-<f l-<f l-<f 

[0184] Considering the quotient ES ( VaR ) = _L_ + P-% u one can see tnat wnen 

VaR 1 - £ (1 - ^)VaR 

pushing the VaR to infinity the quotient converges to ^—^ ■ Here one sees clearly how 
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the tail parameter ^ determines asymptotically the ratio between the value at risk and 
the expected shortfall. A nice property of the expected shortfall is the subadditivity. 
[0185] At this point the Lopez estimator is now introduced 



The quality of the model can be assessed by comparing the value C with the 
corresponding value for a random realization according to the model. If the model is 
accurate the values should lie close together. 

[0187] 5.2.10. A comparison IMA -LDA 

[0188] Having described two advanced measurement approaches, the IMA and the 
LDA, one wonders which of these approaches is most suitable for the purposes of a 
particular bank. At this stage the advantages and disadvantages of the respective 
models are discussed. Figure 4 shows a table of the advantages and disadvantages. 
[0189] As a conclusion one can see that there is no best approach: there is always a 
trade-off between complexity/accuracy of the model and the necessary 
implementation/maintenance effort. Which approach to choose is essentially a matter of 
the bank's preference. 

[0190] 5.3. The scorecard approaches 

[0191] In this section the third type of an AMA is introduced: the scorecard approach. 
In this approach historical loss data is evaluated as well as additional internal ratings 
which might reflect qualitative information. The scorecard can be based upon the IMA or 
the LDA. 

[0192] 5.3.1. Conditional loss frequency: the regression approach 
[0193] Given an internal operational rating with values x t , where t is a time 

parameter, one may assume that the loss frequencies are related with the internal ratings 
as regressors. The procedure is then as follows: 

1 . Develop a hypothesis about the frequency distribution of loss events, and derive 
the respective distribution parameters. 

2. Model the relation between the distribution parameters and the rating classes. 
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3. Use a maximum likelihood estimation to extract the common distribution 
parameters for the sample data. 
[0194] For the calculation of the number of losses per period in a unit conditional on 
the value of one or several risk ratings for that unit, one can use a regression approach 
for count data. A widely used choice to study count data is the Poisson regression model. 

[01 95] 5.3.1.1. The Poisson regression model 

[0196] The Poisson regression model specifies that the number of losses per period 
in a unit y t is drawn from a Poisson distribution with parameter X t , which is related to 
one or several ratings as regressors x, . The primary equation of the model is 

P(Y t =y t ) = =K ^ =0,1,2,... 

[0197] The most common formulation for A t is the log-linear model, \nA t = /?'x r 
[0198] The expected number of losses per period in the unit is thus given by 

E\y t \x t ]=Var\y t \x t ] = A t =e^<. 
[0199] The parameters of the model can be estimated by maximum likelihood using 
the log-likelihood function 

\nL = jr[-A t +y t /?x t -]ny t i]. 

t=\ 

[0200] 5.3.1 .2. Testing for overdispersion in the regression 
[0201] The Poisson regression model implicitly assumes that the variance of y t 
equals its mean by supposing a Poisson distribution for the frequencies. This assumption 
can be tested against the alternative of a negative binomial distribution by a Lagrange 
multiplier test. The LM statistic for this case is 



LM = 



[0202] Under the null hypothesis of no overdispersion this test statistic is distributed 
standard normal. If the null is rejected, a negative binomial model should be estimated. 



[0203] 5.3.1 .3. The negative binomial regression model 
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[0204] One can generalize the Poisson model by introducing an individual, 
unobserved effect into the conditional mean, 

log//, =j?x t +s t 

where u t = exp(^) is assumed to be gamma distributed. Note that conditional on x, and 
s t the distribution of y t remains Poisson. The density of y t conditioned on x, only is 
given as 



fly | X )= + r y '(\-rY wherer = 



which is one form of the negative binomial distribution. The model parameters can here 
as well be estimated by maximum likelihood. 

[0205] 5.3.2. Application of Bayesian transformations 

[0206] In the scorecard approach, banks start with a valid initial allocation of capital 
charges to the individual nodes of the three-grid. Then the amounts are modified over 
time using scorecards. The initial allocation might have been obtained by one of the 
previously discussed approaches. 

[0207] The scorecards may be based on the evaluation of Key Risk Indicators (KRI) 

which serve as proxies for the underlying operational risks for the individual nodes. The 

scorecards must have a sound quantitative basis in order to qualify as AMA. The main 

difference to the IMA and the LDA is that the scorecards do not exclusively rely on 

historical loss data but also reflects the current business situation. 

[0208] A systematic approach to modify scorecard data is to use Bayes 

transformations which incorporates new loss data into existing loss estimations. Starting 

with a prior density, internal data might form a sample likelihood. These two components 

of information are used to determine a posterior density for the relevant random variable. 

The central part in this methodology is Bayes' rule 

p(YlY) _ P(Y\X)P(X) 
P(Y) 

[0209] This relation shows how the probability distribution of the random variable X 
can be revised using prior information about the variable Y . This strategy can be also 
followed for statistical models where the estimation of model parameters is central. The 
problem is to determine the probability of the parameters given certain data. Bayes' rule 
for distributions reads now 



-32- 



-33- 

P(Data I Parameters)P( Parameters) 
P(Parameters \ Data) = — ! p^Data) ' 

[0210] Noting that P(Data) is just a scaling factor one reformulates the rule to 

P{Parameters \ Data) <x P(Data \ Parameters)P(Parameters) . 
[021 1] A corresponding result holds for the density functions of continuous random 
variables 

h(Parameters \ Data) oc g(Data \ Parameters) • h 0 (Parameters) . 
[0212] The second factor on the right hand side reflects the prior beliefs about the 
model parameters (prior density), and the first factor reflects the likelihood of the 
observed model data (sample likelihood). The product is then the density (posterior 
density) incorporating prior beliefs and sample data information. 

[0213] In general the posterior density has a smaller variance as the prior one and as 
the sample likelihood. Bayes' method combines subjective information (prior density) and 
objective information (sample likelihood) to a new more accurate information about the 
model parameters. 

[0214] In the scorecard approach loss data is used to determine the prior densities. 
Internal loss ratings incorporate qualitative data, and these are subsequently applied to 
transform the prior density into a posterior one. A detailed description of this process will 
be given in the latter part of this section. 

[0215] This section consists of two major parts: the first one is concerned with the 
application of Bayesian transformations for the IMA, the second part is then concerned 
with the LDA. But first the procedure of the Bayesian transformation process is 
described. 

[0216] 5.3.2.1 . The Bayesian process 

[0217] Again one may assume that there exists an internal operational rating with 
values X = fo, ...,*„}. 

1 . Develop a hypothesis for the type of the frequency distribution, and determine the 
respective distribution parameters. This is done on the basis of collected loss data 
(internal or external). If not enough loss data is available, one could also start with 
an expert prior. 

2. For a set of internal operational ratings X = {jc, , . . . , x n } apply a regression model 
to find the distribution parameters for the likelihood function. This is a favorable 
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approach, if the user wants to automate the process as far as possible. If that is 
not the case, all parameters can be based on expert estimates and as such the 
automatically generated parameters can be overwritten. 
3. Use the likelihood function to transform the prior density into a posterior density 
which has more favourable properties. The corresponding distribution thus is 
derived from historical loss data as well as qualitative information obtained from 
internal ratings. 

[0218] 5.3.2.2. IMA: The normal distribution 

[0219] In the IMA, banks are required to estimate the loss probability (PE ) for each 
individual node of the grid. One can assume that this probability follows a normal 
distribution. Let N(ju,a 2 )(PE) be the prior, a normal distribution with mean // and 

standard deviation a. 
[0220] Prior density 

[0221] A prior density for the loss probability distribution is easily obtained by 
computing the mean respectively the standard deviation of a sample set of data. 
Alternatively one could start with an expert prior to be obtained as described above. 
[0222] The Bayes transformation 

[0223] Let X = , . . . , x n } be a set of internal operational ratings. One determines the 
expected loss frequency 7j on the basis of this rating data, while assuming the variance 
r 2 is known. This way one obtains a distribution N(rj,r 2 ) of the sample. The posterior is 
then also normally distributed with density function 



h(PE\n) = -^—N 
V ' /J dPE 



T 



M 2 2 

^ {ncr +t j 



+ 7 



ncr 



na 2 + r 2 



T 



1 + 



(PE) 



[0224] In practice, risk management activities will mainly influence the frequency of 
loss events, not their severity. Thus it suffices to describe a Bayesian process for the 
optimization of the frequency function only. 

[0225] 5.3.2.3. LDA: The Poisson case 

[0226] First, one may assume that the frequency distribution is Poisson, i.e. it is 
governed by the mean ju with corresponding density 
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P(x)= ' 



[0227] The task is now to find good estimates for the parameter // which one may 
assume to be r -distributed. The general density for the r -distribution is 



exp 



f(ju) = v - J p — v ^ — , where // > A and > 0 . 

mOOQl lr> +hio r>oeo ono hoc ; - O anH thi IQ fY //> = ft} ex P(H>//?)) | t - 

IV^fcUj III Mil ^vjw wi I /(/ \s i w-. .~ «■■ ^ \/*~/ _ — , , N 

A-r(/) 

interesting to note that the parameter fi is here a scaling factor since using the 

substitution y := — one has 

P 

L_ 

[0229] But as one may want to include information of genuine data one has to take 
the distribution T fi . Of course one could alternatively work with the standardized 
Gamma-distribution, but then the additional information would need to be standardized 
as well, and finally one would need to perform a back-transformation. 
[0230] The prior density 

[0231] The only parameter which needs to be estimated initially is y , and this can be 
done by the method of moments estimator ^— j and the corresponding scaling 

2 

parameter is /? = — , where Ju and a are the mean respectively the standard deviation 

A 

of the sample data. 

[0232] If this estimation process seems to be not favourable one could simply start 
with the improper density, i.e. a constant function as a prior, or with an expert prior. 
[0233] The Bayes transformation 

[0234] In addition to the loss data the Basel II accord requires banks to include 
qualitative data as well. A central role plays here an internal operational risk rating 
obtained via a bottom-up approach. 

[0235] Taking now a set of rating classes X = {x x , . . . , x n } , one can estimate the 
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parameter // of the corresponding density function g(x) = — exp ^ ^ , for example 

x\ 

using expert insight. The expected frequency of this distribution is x := // . Now one fixes 

the mean frequency x and regard g as a function of the Poisson parameter // (here // 

is a particular value of the Poisson parameter). The function g{ju) will be used as the 

likelihood function in the Bayesian transformation process. 
[0236] For the posterior density one obtains again a r -density 

1+/? _ Y+£_ 

. — n If I ^\v-\ _,///? V v -,,\ ^1_v vx7-1 A /? vo.v-1 M R 

niji\x)K\yiipj e j^re - )= p~ ' M' e " x M e - . 

[0237] The parameters for this transformed density are y = y + x and ft = /J 



\ + j3 
Thus one has 

i( ,| jl = Ar. Mg M^!H^), 

[0238] This is now a new estimate for the density function of the Poisson parameter 
distribution. The loss distribution is then obtained by a two-stage Monte Carlo simulation 
where first a Poisson parameter value is drawn to determine the frequency distribution. In 
the second stage, vectors from the frequency and severity distributions are drawn to give 
the loss distribution. Alternatively one could take the expectation value of the parameter 
distribution as the Poisson parameter and perform then the usual Monte Carlo 
simulation. 

[0239] Instead of performing a two-stage Monte Carlo simulation, one can first write 
down a closed expression for the density function of the frequency distribution, a 
negative binomial distribution, and then perform the simulation 



( h V 



x\Y{y) 



P 



1 



Y 



/? + ! 



[0240] 5.3.2.4. LDA: The negative binomial case 

[0241] Now the more general case where the frequencies of loss events follow a 
negative binomial distribution is described 

p(x) = r(x + r) P r (i- P y. 

jtT(r) 

[0242] In this case one may keep the variance fixed and use the likelihood function of 
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a sample to improve the estimate of the event probability p . One may assume that the 
mean of the event probability is beta distributed with density function 

f(p)oc p a {\-p)\ where 0<p< \ and a,b>0. 
[0243] The prior density 

[0244] The probability p needs to be estimated initially. If a sample set of size n the 
number of event observations is m the maximum likelihood estimator for p is the 

quotient — . The corresponding prior density is then 

n 

f(p)*p n - m (l-p) m - 
[0245] Alternatively, one can here as we!! start with a constant density over the 
interval (0,1) as prior, or with an expert prior. 
[0246] The Bayes transformation 

[0247] For the transformation one may include again internal rating data 
X = {x l9 ...,x H }. One can estimate the expected loss frequency ju , and thus the 

respective model parameter for the negative binomial distribution: p = and 

(j 

2 

r = — ^ — , where the variance a 1 is assumed to be fixed. Now one may set x := // 

cr 2 -// 

and regard the density function as a function of p while keeping x fixed. The parameter 
p is a particular value of the distribution parameter;? . The function g(p) will now be 
used to transform the prior beta-density / . For the posterior density one obtains 

Kp\x)<x[p a (l-p) b \ 



x\T(r) 



<xp a+r (l-p) 



again the density function of a beta-distribution with parameters a = a + 7 and b = b + x . 
Thus one has 

Kp\x)= r («+* + 2) , i= 1 fi , 

T(a + l)r(b + l) B(a + l,b + l) 

[0248] This gives now a new estimate for the density function of distribution 
parameters. The corresponding loss distribution is obtained by a two-stage Monte Carlo 
simulation where first a value of the event probability p is drawn to determine the 

(per) 2 

frequency distribution (recall here that for the negative binomial distribution r = l j ' ). 
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In the second stage, vectors from the frequency and severity distributions are drawn to 
give the loss distribution. 

[0249] Alternatively, one could take the expectation value of the parameter 
distribution as the value of the event probability and perform then the Monte Carlo 
simulation. 

[0250] Instead of performing a two-stage Monte Carlo simulation, one can first write 
down a closed expression for the density function of the frequency distribution, a Beta- 
Pascal distribution, and then perform the simulation 

fix) = T(X + r \ V" (1 " P)^ dp = r(x + r)J(r + g + U + fe + l) 

x! T(r)B(a + 1, b + 1) 0 J * x\ T(r)B(a + 1, b + 1) 

[0251] 5.3.2.5. Bayesian networks in operational risk measurement 

[0252] In this section the application of Bayesian networks for finding the operational 

loss distribution is described. Here one needs to apply the following steps: 

• Identify the factors relevant for operational losses; 

• Perform back-testing with historical loss event data to optimize internal model 
parameters; 

• Determine operational value at risk using scenario analysis. 

[0253] Let b be an estimate for a model parameter . It is viewed to be an optimal 
choice when the loss function is minimal. Two prominent types of loss functions are 
The absolute function L(j3,b) =\j3-b\ \ 

The quadratic function L(/?,b) = {fi-bf . 
[0254] The estimators for these loss functions are the expectation value respectively 
the median of the posterior distribution. 

[0255] In the case of operational risks one is for example interested in estimating the 
expected loss EL . For the sake of simplicity, one may start with a prior density of the 
expected loss. This distribution can be assumed to be normal. 
[0256] When additional data becomes available, a sample distribution can be 
produced. The assumption of a normal distribution would here be valid, thus computing 
of the mean and the variance determines the distribution. The resulting sample likelihood 
is then multiplied with the prior density giving the posterior density. So one obtains a new 
estimation EL for the expected loss being the basis for the computation of an 
operational risk charge. As described above, this is an ongoing process with increasing 
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[0257] 5.3.2.6. Consideration of Insurance for Scorecard Approaches 
[0258] Depending on whether one applies the scorecard approach on the basis of 
the IMA or the LDA, the insurance considerations will be accordingly as outlined in the 
previous sections. The insurance will be as far as possible included on the elementary 
node level to allow a specific risk allocation. 

[0259] 5.4. Model Back-Testing 

[0260] The details of block 80 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 

[0261] All quantitative results are of course subject to back-testing for the validation of 
the models. One constantly needs to verify that the frequency and severity distributions 
are correct in order to ensure an adequate level of operational capital charge. The most 
prominent back-testing procedures include statistical tests including: 

• The Kupiec test; 

• The textbook proportions test. 

[0262] 5.4.1. The Kupiec test 

[0263] The most important first check for a model is whether the 99.9%-quantile 
holds or not. This can be done using the Kupiec-Test: exceptional observations (i.e. 
observations lying in the quantile) are modeled as independent draws from a binomial 
distribution. 

[0264] For the confidence level c (e.g. 99.9%) the probability for k observations out 
of n to lie in the quantile, i.e. exceeding the value at risk, is 



P(N = k) = 



(1 - c) c n , where N is the number of extreme observations . 



n — k 

[0265] Introducing a := , one may want to test the null hypothesis 

n 

H 0 : c- a 

[0266] The test LR = 2(ln(a n ~ k (l-a) k )- ln(c n ' k (1 - c)* ) is asymptotically % 2 (1) 
distributed under the hypothesis H 0 . With a likelihood ratio test statistic, one has a tool to 
reject bad models. The power of the test increases with the sample size n . 
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[0267] The Kupiec test is not particularly powerful as it requires many data points. 
Nonetheless it is an important test for the model validation. 

[0268] 5.4.2. The textbook proportions test 

[0269] This test is for checking whether the frequency of failures differs significantly 
from the predicted one. 

[0270] Let the null hypothesis be H 0 : The probability for frequency k is p . 
[0271] And the hypothesis H x : P(k) * p . 

[0272] For sufficiently large sample size n one might assume a binomial distribution 
with u = np and a = Jnp(l-p) . Transforming this binomial distribution to a distribution 
with expectation value 0 and standard deviation 1 , one uses the standard normal 
distribution with a prescribed confidence level for the test. 

[0273] 5.4.3. Stress testing and sensitivity analysis 

[0274] The details of block 82 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 
[0275] Here two different approaches to understand the local behaviour of a 
particular density function (e.g. for the frequency/severity) is described. 

• As the interesting part is the high severity losses, one may concentrate on the tail 
only. Here the relevant parameters are the threshold u and the tail parameter ^ . 
One sensible sensitivity analysis is to study the behaviour of the distribution when 
one decreases or increases these parameters by say 10%. This can now be used 
to define a band of values at risk depending on the scenario. 

• Another sensitivity test is when one increases/decreases all loss data by 10% in 
the first place and then perform the analysis. Here one can also define a range for 
the value at risk. 

[0276] On may assume that by risk management activities only the frequency of loss 
events can be decreased - while the severity stays unchanged. As an example case, the 
loss distribution of a certain business line on the basis of 16 months of data is described. 
During this period of time 663 loss events were observed leading to a mean monthly 
frequency of 41 .44 events. Now the impact of a reduction of the monthly mean on the 
value at risk is described. The analysis shows that a reduction of loss events of up to 
30% is well possible. 
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[0277] For the calculation one can assume that the frequency follows a negative 
binomial distribution and that the severity can be modeled as a composition of the 
lognormal and the generalized Pareto distribution. When looking at the corresponding 
values at risk, one clearly sees the importance of operational risk management in order 
to reduce operational risk capital. Figure 5 shows a table of values at risk along with 
other risk values. 

[0278] 6. Tool description/design 

[0279] For each node in the aggregation structure, the following must be done by the 
quantification tool: 

[0280] 1 . Load loss data and their loss (event) date. The time frame for data 

collection should be as long as possible to have the chance to collect as much 
data as possible. On the other hand it should not be too long as the collected 
data should reflect the actual risk situation. So it is suggested to have monthly 
loss data collections. It is important to be able to allocate the individual loss 
event to a certain point in time, i.e. all data needs to be collected with a loss 
date. See block 300 of Figure 42. 

[0281] 2. Load insurance data on the node level. Depending on whether the IMA or 
the LDA has been used on this level, the corresponding insurance inclusion 
procedure will be applied. See block 302 of Figure 42. 

[0282] 3. On the upper section of the sheet for each node: check if there is enough 
data to (see blocks 304, 306, 308 of Figure 42): 

a. Model the frequency distribution and the body of the severity distribution: 
print a list of nodes where not enough internal loss data exists. For these 
nodes expert priors need to be created (this should be done only 
infrequently: once, at the very beginning of the modeling exercise and then 
again if the older loss experience has become irrelevant for the present 
risk profile). When an expert prior is used, the weight of the prior (equal the 
number of drawings from the prior distribution) has to be determined. 
Moreover one has to describe how the weight needs to be adjusted in the 
following months. As next month's modeling is best done by copying the 
current month's modeling Excel sheet, write a note with the updated 
weights. Determining an expert prior and the corresponding weight is a 
manual process. 
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b. Model the tail of the severity distribution: print a list of nodes where not 
enough data exists. Then include external loss data when needed. Scaling 
and adding external data to the data set of the node is a manual process. 

[0283] 4. The next section of the sheet covers the calculation of the IMA for a node 

(see block 400 of Figures 42 and 43): 

a. Determine for each node the expected event probability by calculating an 
average frequency. See block 402 of Figure 43. 

b. Determine for each node the LGE. This is the medium loss amount. See 
block 404 of Figure 43. 

c. Using the y ijk as set by the regulators, compute the required operational 

capital charge. See block 406 of Figure 43. 

d. Use Chebychev's inequality for a very rough check on the adequacy of the 
operational capital charge. See block 408 of Figure 43. 

e. Calculate the impact of insurance coverage on the capital charge. See 
block 410 of Figure 43. 

f. Report the expected loss and the unexpected loss with and without 
insurance coverage (if applicable). See block 412 of Figure 43. 

[0284] 5. The next section covers the LDA for a node (see block 500 of Figures 42 
and 44): 

a. Determine expectation value and variance of frequency data. If they agree 
assume a Poisson distribution model for the frequency, otherwise assume 
a negative binomial distribution. Alternatively compare the frequency Q-Q 
plots for the Poisson and for the negative binomial distributions and 
choose the best fit. See block 502 of Figure 44. 

b. To determine the severity distribution, determine the threshold 

u automatically to separate low severity from high severity data. To find u 
draw the Hill graph and identify the stable area. Of course, the threshold u 
can also be modified manually. See block 504 of Figure 44. 

c. Model the severity distribution for t < u assuming a lognormal distribution. 
See block 506 of Figure 44. 

d. Model the tail using EVT. See block 508 of Figure 44. 

e. Fit the two pieces of the severity distribution to obtain a complete 
description. See block 510 of Figure 44. 
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f. Consider insurance cover. See block 512 of Figure 44. 

g. Derive the loss distribution using Monte Carlo simulation. See block 514 of 
Figure 44. 

h. Determine the operational value at risk at a confidence level of 99.9%, the 
expected value and the Expected Shortfall from the model. See block 516 
of Figure 44. 

6. For the scorecard approach one has two sections - one for scorecard on 
the basis of IMA and one on the basis of LDA. The respective procedures do 
not vary significantly (see block 600 of Figures 42 and 45): 

a. Find the prior frequency distribution on the basis of internal and external 
loss data, or where these are not available on the basis of expert priors. 
See block 602 of Figure 45. 

b. Use ratings to improve distribution estimates via Bayesian transformations, 
or update the prior frequency distribution using a regression model. The 
model choice is a manual one, to be made prior to the modeling. Instead of 
applying a regression model one could as well translate a rating into a 
frequency density via expert insight. The Bayesian transformation 
procedure is otherwise the same. See block 604 of Figure 45. 

c. Include insurance coverage. See block 606 of Figure 45. 

d. Derive the updated loss distribution using Monte Carlo simulation. See 
block 608 of Figure 45. 

e. Compute updated VaR, Expected Shortfall and Expected Loss. See block 
610 of Figure 45. 

7. Calculate the aggregated VaR, Expected Shortfall and Expected Loss 
values by running a background simulation — report aggregated (see block 
320 of Figure 42): 

a. IMA with and without insurance per node and in the pre-determined 
aggregation structure. 

b. LDA with and without insurance per node and in the pre-determined 
aggregation structure. 

c. Scorecard on the basis of IMA with and without insurance per node and in 
the pre-determined aggregation structure. 

d. Scorecard on the basis of LDA with and without insurance per node and in 
the pre-determined aggregation structure. 
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[0287] 8. Scenario analysis. In order to derive risk management activities out of the 
measured risk potential one needs to understand the dynamical behaviour of 
the system. This is best done by analyzing and studying various scenarios. 
These are obtained by systematically changing the input loss data (see block 
322 of Figure 42): 

a. Modify existing loss data by assuming partial or full failure of mitigation 
processes. 

b. Generate new loss data as possible scenarios, possibly supported by data 
from external loss data bases. 

[0288] 9. Stress testing is used to show stabilities or sensitivities of the model. It can 
be applied to the real model as well as to scenario models. By stress testing 
one modifies systematically internal and external model parameters (see block 
324 of Figure 42): 

a. Modify internal model parameters (thresholds, tail parameters, expectation 
values, standard deviations, etc.) and analyze the situations where these 
parameters are 10% lower/higher. 

b. Modify external parameters, i.e. input loss data and analyze situations 
where all losses are 10% lower/higher. 

c. After the various modifications identify the lowest and greatest sensitivities 
of the model. These give hints towards the impact of possible risk 
management activities. 

d. As a result, ranges for the required operational capital charges for each 
node and for aggregation levels could be defined. 

[0289] 10. Model back-testing is essential for the validation of the models and has to 
be performed as close to the modeling process as possible, i.e. for each 
individual node. Moreover it is sensible to have a rough test on aggregated 
levels as well to ensure the validity of the aggregated information as well. 
Relevant tests are described above. See block 326 of Figure 42. 

[0290] A mathematical procedure to include scenario and external losses 

control-based into the operational risk capital calculations 
[0291] 1 . Purpose of this section 

[0292] The details of block 74 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 
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[0293] The purpose of this section is to outline some mathematical concepts for: 

• calculating event probabilities for scenarios and external loss data using 
internal control information (adaptation of losses to the internal business and 
control environment); 

• the updating mechanism needed to incorporate these probabilities adequately 
into the LDA frequency and severity distribution modeling. 

[0294] The information provided in this section is additional information that may 
support risk managers to assess the applicability of the techniques outlined for an 
operational risk framework. 

[0295] The following procedures are suggestions, and reasonable 
experimentation may be needed to verify that all of these procedures are necessary 
(or sufficient) to create capital adequacy. For example, time may be needed not only 
to create an appropriate model in the quantification tool, but also to test them with 
real data and plausible scenarios and external loss data. 

[0296] 2. Introduction to the modeling process 

[0297] Augmenting the data basis of internal losses with scenarios and external 
losses is a common concern for banks as it is generally observed that there is not 
enough internal loss data to estimate the tail of the loss distribution correctly. 
[0298] The following modeling steps are necessary, when incorporating scenario 
losses or external losses. Please note that not all steps are described in detail in the 
following sections, but the focus is on those steps that require new/adapted 
mathematical procedures: 
[0299] Analysis Part 1 (see section 3): 

[0300] 1 . Identify all controls P k that serve to prevent a specific set of losses 

(loss event types). Equally, identify as many uncontrollable influences to 
the event type as possible (for simplicity reasons left out of the following 
descriptions, but to be treated in the same way). This step is an analysis to 
be undertaken as part of the service/control architecture analysis and 
scenario analysis - it is not further described in this section. 
[0301] 2. Determine the corresponding failure densities f k : (0,1) R >0 . This 

density function belongs to the failure distribution, which describes the 
probability that a particular control point does not discover the loss event. 
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The failure probability is looked at as the event probability (equal the event 
frequency). 

[0302] 3. Determine the loss amount to be included: for external losses, adapt 

the external loss amount to the maximal possible amount A of the bank by 
applying a cut-off function when necessary (e.g. the amount of the highest 
ever transaction). For scenario losses, loss amount is part of the analysis. 
Not further described in this section. 

[0303] Analysis Part 2 (see section 4) 

[0304] 4. For the severity distribution, one may make the assumption that 

Extreme Value Theory (EVT) is to be used to model the tail of the severity 
distribution. Determining the position of the threshold between body and 
tail of the distribution is the challenge when incorporating scenario and 
external losses. There are models to calculate the threshold of external 
data and mixing mechanisms. These models should be taken into account, 
evaluated, and tested for plausibility. For the time being though, there is 
little functional reasons to adjust the threshold as: 

• one will want to use the scenarios and external losses for calculating a 
better fit for the tail of the distribution only; 

• one will not want to change the information contained in the internal data, 
but instead make the best use of the internal information. 

Thus, it is suggested to estimate the threshold from the internal data and to 
keep it there, when incorporating scenario and external losses. 
[0305] 5. Use the scenario and external loss amounts for updating the tail 

parameter of the Generalized Pareto Distribution used to model the tail of 
the severity distribution. One will expect the form of the tail of the 
distribution to change, when scenarios are incorporated and one will want 
the Monte Carlo simulation to draw from that new tail. A Bayesian updating 
mechanism is described below to do that. Please note that incorporating 
more losses in the tail of the severity distribution will change the probability 
weight between the tail and the body of the distribution (not to be confused 
with the frequency: the probability weight refers to the changes to the form 
of the overall severity distribution that will be the result of the estimation 
process, when the proportion of number of losses in the tail and number of 
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losses in the body changes). As one will not want to make any significant 
changes to the body of the distribution, a procedure is described below to 
maintain the probability weights between the body and the tail of the 
severity distribution. 

[0306] 6. Incorporate loss event probability and loss amount in the overall loss 
distribution to make sure that scenario and external losses that are 
estimated to fall under a certain quantile can be traced back in the 
resulting capital amount. This must be implemented in the Monte Carlo 
simulations for the convolution of frequency and severity distribution. The 
mathematical concepts of doing so are described below. 

[0307] In the following sections, more detailed mathematical descriptions of steps 

2, 5, and 6 are provided. 



[0308] 3. Calculating internal event probabilities for a scenario or external loss 
[0309] There are two main objectives for using an assessment of the loss 
prevention quality of the internal control environment to assess an event probability 
for external losses and scenario losses: 

[031 0] 1 . To assess the degree of applicability of a scenario or external loss to 
the bank, it is a major concern with all external data collections and also 
scenarios that the applicability - or probability of occurrence - to the 
internal processes. In the case of external losses, there is no saying which 
controls failed for the other bank. In the case of scenarios, one must 
clearly be aware of the fact that just about anything can happen. The 
question is, how likely it is that it will happen. The procedures to assess 
the quality of controls must come up with the part of the event probability 
that can be controlled. Uncontrollable factors (like the probability for an 
earthquake or a terrorist attack) must be singled out and assessed. 

[031 1] 2. Using internal control information to assess the event probability gives 
an incentive to business managers to invest in controls. If the procedures 
are such that the scenario with its event probability and loss amount is 
closely related to the resulting capital figure, understandable business 
cases can be created for control investments. 

[0312] In the following, a mathematical procedure is described to calculate such 

event probabilities that is based on control information. Please note that the 
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uncontrollable part of the event probability can be incorporated without difficulty, 
although the description focuses on the controllable part of the event probability. 

[0313] 3.1 . Failure densities for sequences of controls 
[0314] Crucial for the inclusion of external loss data is the thorough 
understanding of the internal loss prevention system. This system consists of what 
one may call control points, whose function it is to prevent loss events. Control points 
must be evaluated by KRIs to be able to derive enough data to base a statistical 
experiment upon. The KRIs shall be measurable and - whenever possible - directly 
linked to loss events. Figure 6 shows a diagram of an approach to the adaptation of 
scenario and external loss data. 

[0315] Controls can fail, thus their probability of failure will be captured by the 
KRIs. For specified time intervals the failure rate as captured by the KRIs is 
measured. This rate serves as a proxy for the failure probability. 
[0316] The corresponding failure distribution is what one is interested in and what 
one needs to calculate from the KRI proxy for the adaptation of scenario and 
external loss data (normal statistical fitting). 

[0317] Assumptions. One assumes that all control points are arranged 
sequentially and that they are independent of one another. 
[0318] These assumptions are justified as: 

[0319] 1 . The sequential order is supported by the sequential activities in any 
process. 

[0320] 2. Independence of control points is one crucial criterion for their 

implementation: if two control points would be highly correlated, one of 
them could be omitted without loosing control quality. 

[0321] 3.2. Mathematical representation of the event probability 
[0322] For the time being and having not observed any contradicting information, 
one may assume for the sake of simplicity that the failure probability is normally 
distributed, i.e. it suffices to find the mean and the variance for a complete 
description of the distribution. 

[0323] With time, back-testing results might suggest using other models for the 
failure probability. The mathematical principles described below remain the same. 
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[0324] For a particular external loss event let P x ,...,P k be the set of relevant 
control points, and let /,,... ,f k , where f t : (0,1) -» R >0 , be the corresponding failure 
densities. 

[0325] The common failure density for that event is then obtained as 

F{t) = ; fx *•••*■/*(*> , W ith o < t < 1 . 
J/, * - *f k (x)dx 

0 

[0326] Here one uses the * -operation defined by 

/;■ */,(') r)f t ix)fj{t/xybe. 

[0327] The expected failure probability for the specific loss event is then 

i 

P= jt-F(t)dt. 

0 

[0328] In practice one assumes that the failure probability is normally distributed 
over the interval [o,l]. The expected failure probability will be regarded as the internal 

frequency of the scenario or external loss event and as such included in the loss 
distribution modeling process. 

[0329] 4. Incorporating event probability and loss amount in the overall loss 
distribution 

[0330] Obviously, there is more than one way to update the loss distribution with 
the scenario and external loss event information. 

[0331] A summary of the objectives to be applied to a procedure are as follows: 
[0332] 1 . Get a better fit for the tail of the severity distribution: 

o In theory, the optimal severity distribution outcome would be a 

validation of the results obtained using internal data only (as, again in 
theory, a statistical model has the ability to 'extrapolate' a 99,9%- 
quantile to have data available in all parts of the distribution is not 
necessarily required for the estimation process), 
o Practically, though, one uses scenario and external losses, because 
there is not enough basis for estimating the parameters of the 
distribution in the tail correctly. It is assumed that the distribution that 
can be calculated from the internal data will 'peter out' too quickly. So, 
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given the imperfect state of any statistical modeling process, the 
expectation towards the severity distribution is that it will get a 'fatter' 
tail, i.e. the 99,9%-quantile will move to the right, 
o This objective is addressed in section 4.1. , where a Bayesian updating 
mechanism that takes the new scenario and external loss data 
information into account to update the internal loss data information 
contained in the tail parameter £ is introduced. 
[0333] 2. Keep the body of the distribution to rely on internal data only: 

o The assumption is that the internal data points suffice to estimate the 
body of the distribution: when e.g. calculating the expected loss for the 
next period, one (at least in the LDA) relies on the loss experience of 
the previous period, which one expects to represent the appropriate 
weights between frequency and severity distribution, 
o When inserting loss data points in the tail of the distribution, all fitting 
procedures for the severity distribution will recognize the additional 
data points as additional weight given to the tail, thus making the tail 
even fatter. This additional weight is not appropriate though, as one will 
want to rely on the internal data to give the proportion of data in the 
body and data in the tail (see also discussion about threshold above). 
As much of the original internal data information should be kept, 
o In 4.2., the appropriate mathematical adjustment of the information in 
the tail according to the amount of scenario and external loss data that 
are added to it is described. 
[0334] 3. To create pragmatic and plausible capital updates, one will want to 
make sure that a scenario or external loss, whose event probability was 
calculated to lie within the range of the 99,9%-quantile to either justify the 
event probability given to the scenario loss amount in the original Monte 
Carlo simulation or to move the amount of the 99,9%-quantile to the right 
by at most the scenario loss amount (range of possible outcomes). 
Scenario and external losses that are calculated to lie outside of the 
99,9%-quantile, one expects to be taken into account only minimally by the 
overall loss distribution (they shall be subject to better estimation of the tail 
parameter only, see point 1 ). This creates problems for the accepted way 



-50- 



-51- 

of modeling of the frequency and severity distribution independently: 
o the frequency distribution will hardly change at all by adding a very 

small event probability to it - thus making the efforts of calculating the 

event probability not worthwhile; 
o the common estimation procedures for the severity distribution will 

most likely overstate the severity as no connection can be created 

between the high loss amount and the small event probability 

associated with it; 

o an updating mechanism to the already convoluted loss distribution to 
meet this objective is therefore suggested as described in 4.3. 
[0335] Some experimentation may be needed to verify that all three of these 
procedures are needed (or sufficient) to create capital adequacy. For example, time 
may be needed not only to create an appropriate model in the quantification tool, but 
also to test them with real data and plausible scenarios and external loss data. 
[0336] In the following, the mathematics as described above are introduced. 

[0337] 4.1 . Updating the tail parameter of the severity distribution 

[0338] A Bayesian updating mechanism seems most adequate for updating the tail 

parameter which will determine the new form of the severity distribution after taking the 

scenario or external losses into account. 

[0339] Bayesian statistics revolves around Bayes' rule: 

V ' ' P{Y) 

[0340] This relation shows how the probability distribution of the random variable X 

can be revised using additional information as expressed in the variable Y . It can be 

shown that the result will have favorable statistical properties. 

[0341] This mechanism can also be followed for statistical models, where the 

estimation of model parameters needs to be revised. The problem in this case is to 

determine the probability of the parameters given additional (loss or scenario) data. 

[0342] Bayes' rule reads now: 

PCData | Parameters)P(Parameters) 

P( Parameters Data) = — ! - 1 - 

P(Data) 

[0343] Noting that P(Data) is just a scaling factor, the rule reformulates to 
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P(Parameters \ Data) oc P(Data \ Parameters) P(Parameters) . 
[0344] A corresponding result holds for the density functions of continuous 
random variables. 

[0345] Applying the Bayesian updating process to the case of updating the tail 
parameter £ requires the calculation of 1 . a prior density for the parameter £ 
{P(Parameters) ) and 2. the so-called Likelihood Function P{Data \ Parameters) . 

[0346] 1 . Calculation of the prior density for the parameter £ ( P(Parameters) ) 

[0347] The information used to calculate the density function f(£) is the internal 
loss data. 

[0348] A recap of how the tail of the severity is calculated using the Generalized 
Pareto Distribution (EVT) follows. 

• One has a threshold u , which separates the body from the tail of the distribution. 
In this case, one may opt for letting the threshold remain the same as when one 
calculates the tail on the basis of internal loss data only. 

• Let the internal loss amounts X x , . . . , X n be independent and identically distributed 
(iid). On may assume that there are k observations larger than u . 

For the order statistics X k n < X k _ ln < • • < X l n one may define the estimate for the 

tail parameter § as 



[0349] One can now see how to determine the prior distribution function f(£) for the 
parameter 

• One assumes that the tail parameter ^ be r -distributed. That assumption seems 

valid from a certain analysis of the Hill Plot and the fact that the Gamma distribution is 
fat-tailed itself 

• The general density for the r -distribution is 



i = ±f,QnX, n -lnX kn )=:H kn , 

K i=\ 



the average of differences of the k observations in the tail. 
• This defines the following distribution function for the tail of the severity 
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1 exp - - 



f(& = ±JLJ——± — ?-l , where £>A and J3,y>0. 
P-^ir) 

In this case one has A = 0 , and thus f(g) = ^IMlE^kMJJh . 

Note that the parameter j3 is a scaling factor. 
• The parameter to be estimated initially is y , which can be done using the method of 



- \2 



( P\ 



rr 



2 



moments estimator — ; the corresponding scaling parameter is J3 = , where 4 

[a) " ^ <f 

is the tail parameter estimated on the basis of the interna! loss data, and 
a = ^]v3i{H k n : 1 < k < n - 1} the standard deviation of the tail parameters. 
This leaves a solution for the prior density for the parameter £: (P(Parameters) ). 



[0350] 2. Calculation of the Likelihood Function P(Data \ Parameters) 

• The Likelihood Function is to be calculated using the scenario information, as this is 
additional information on the same subject of Using the threshold as above, one 
may use the scenario losses to come up with a new estimate of the tail in the form of 
a Generalized Pareto Distribution (GPD). 

• Another estimate g of the tail parameter determines the GPD, which defines the 

density function for the tail parameter distribution. 4 is estimated by using the 
scenario losses. 

• The function g(g) , which will be used as the likelihood function in the Bayesian 
updating process, is obtained through a simple transformation (exchanging 
variables...)- As a result, the tail parameter is regarded to be the independent 
variable. 

[0351] Recall that the result of the Bayesian updating process is the posterior 
distribution: 

P{Parameters \ Data) oc P(Data \ Parameters)P(Parameters) . 
[0352] Inserting the results, one obtains: 

h(£ | scenario losses) oc /(£) ■ g(£) . 

[0353] The mean E(h) of the distribution h is used as the updated tail parameter^. 
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[0354] 4.2. Maintaining the probability weight in the severity distribution 
[0355] Let $ be the density function for the severity's tail as calculated on the 

basis of the internal loss data only and $ be the density function for the severity's 
tail as it results from the Bayesian update on the tail parameter as described in 4.1 . 
[0356] The tail will then be normalized to the same probability weight as it had 
been on the basis of internal loss data only: 

fe)-^— — 

t>u t for x — u . 
[0357] This normalization process has to be solved numerically. 

[0358] 4.3. Updating the overall loss distribution 

[0359] In order to create the link between the high loss amount of the scenario of 
external loss and the appropriate small event probability, the final updating will be 
done directly in the (convoluted) loss distribution L(t) . 

[0360] This way a three-step model for calculating the overall loss distribution is 
created: 

■ Model Frequency and Severity independently (for the severity either on 
the basis of internal losses only or using the updated tail parameter § 
from step 1); 

■ Run the Monte Carlo convolution; 

■ Update the data point on the y-axis of the loss distribution, where the 
scenario loss is located with the new probability weight as calculated 
as event probability for the scenario - thus updating the y-axis of the 
loss distribution (the same for external losses, of course). 

[0361] Let L be a scenario loss amount with event probability p . The inclusion 

procedure is as follows: 

[0362] 1 . Rescale the y-axis of the loss distribution by the factor (1 - p) . Figure 7 
shows a graph of rescaling of the loss distribution. 

[0363] 2. Attach to the scenario loss amount the appropriate event probability p . 
Figure 8 shows a graph of adding of a scenario loss event. 
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[0364] This way again a loss distribution is obtained including the scenario loss 
information. The corresponding operational capital charge for a defined confidence 
level (in general 99.9%) can then be read off. 

[0365] When Monte Carlo simulation is used - as is the case for the described 
quantification tool - this updating mechanism is very easy to do. 

[0366] Demonstration of the capital calculation prototype 

[0367] Capital calculation functionalities are an important part of Operational Risk 

Management and must be based on a sound risk indicator and loss management. 

The capital calculation prototype serves to test some basic and enhanced capital 

modeling techniques. Figure 9 shows an illustration of requirements and 

methodology. 

[0368] Basic Capital Calculations are based on historic losses mainly. IMA and 
LDA type calculations are used by the prototype. Figure 10 shows an illustration of 
basic capital calculations. 

[0369] Enhanced capital calculations incorporate qualitative assessments (KRIs, 
ratings etc.) to update the calculated capital and scale external events. Figure 1 1 
shows an illustration of enhanced capital calculations and scaling of external data by 
calculating an event probability. 

[0370] Models for operational risk capital are by far less mature than for other risk 
types. Thus, creativity and scepticism should be applied to even the most 'natural' 
modeling components: 

[0371] Uncertainties around the capital calculation functionality: 

• Correlations: 

- Regularly calculated for 'normal 1 portfolio models, there is little 
evidence for their importance from a functional perspective (if a 
consistent underlying business model is used). 

- Data collections are small. Could correlation parameters be estimated 
with any statistical significance? 

- Necessary or misguided precision? 

• Scenarios: 

- Which parameters describe a good scenario? 

- Simple and useful sensitivity analysis on certain easy to interpret model 
parameters. Will that suffice? 
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- Qualitative scenarios ('could this happen in our bank?') are very useful. 
Do they require a tool-wise representation? 

• Back-Testing: 

- Most importantly, actual losses must be backtested against a number 
of models (in the initial phases). 

- A longer data and modeling history is a MUST for a successful 
backtesting. 

- The actual backtesting mathematics is then simple. 

• Different convolution and aggregation mechanisms (e.g. Monte Carlo versus 
Numeric models): 

- Necessary or misguided precision? 

• Outlier Problem 

- Data Cleansing should not be done, as the definition of an outlier is 
unknown! Outliers at this stage may just as well indicate model errors. 

- At this stage, all data anomalies must be taken seriously and be 
examined closely! 

[0372] Using the Quantification-Tool for Operational Risks 

[0373] 1. Introduction 

[0374] **** Start Page ('Main Form') of the Tool **** Figure 12 shows the first 
screen display of one version of the quantification tool. 

[0375] This section describes how the quantification tool for operational risk can 
be used for risk assessments of a typical and specific analysis requirement of a user 
of the tool. 

[0376] The Quantification Tool covers all Advanced Measurement Approaches 
(AMA): 

1. The Internal Measurement Approach (IMA) 

2. The Loss Distribution Approach (LDA) 

3. The Scorecard Approaches 

o Scorecard Approach on LDA-basis using internal rating regression 
o Scorecard Approach on LDA-basis using Bayes-update. 



[0377] 
[0378] 



2. Data Structure and Definition of Analysis Units 
The details of blocks 70 and 76 of Figure 2 and blocks 90, 92 and 94 of 
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Figure 3 are described here in the following text along with additional descriptions in 
other parts of the text. 

[0379] **** Click on 'Setup Analysis Units' **** 

[0380] The loss data is organized along four dimensions: business lines, event 
types, organizational units and processes, i.e., every loss event has these four 
attributes and aggregation logic can move across those four dimensions. The first 
two correspond to the preliminary Basel II data structure. The 'Organizational unit' 
and 'Processes' attribute are used to describe the allocation of the loss to an internal 
part of the bank's business model. There might be more necessary attributes. 
However, for data scarcity reasons, a certain abstraction discipline within this tool is 
enforced, as it cannot be expected that there will be enough data to populate more 
than the resulting analysis nodes for these four dimensions. 
[0381] In the present example, there are 896 elementary nodes, depicting the 
Basel II nodes plus a very basic structure of organizational units and internal 
'processes'. 

[0382] An analysis unit summarizes loss data and forms the most elementary 
analysis level. Although the user is free in the definition of analysis units, it is 
recommended to define analysis units to be completely contained within one Basel 
ll-node to ensure data consistency for a valid statistical analysis. 
[0383] For the sake of simplicity, the Basel ll-nodes are already pre-defined as 
possible analysis units. 

[0384] For the example 'external fraud assessment', one may consider only the 
dimensions Basel Business Lines and Event Types. Thus, one aggregates the 896 
elementary nodes into analysis units, which form 'Basel-nodes'. This gives eight 
Basel-analysis units: external fraud across all eight business lines. See Figure 13. 
[0385] **** Go back to the Main Page (click at the door) **** 

[0386] 3. Evaluating an Analysis Unit 

[0387] **** Click on 'Evaluate Analysis Units' **** 

[0388] **** Select 'Bassel-1 6-RB-EF', specify start date as '01.01 .98' and select 
time horizon to be 'Yearly' **** 
[0389] **** Click 'Run' **** 

[0390] After defining the aggregation structure, the risk assessment for the 
analysis units has to be performed. The Quantification Tool covers all Advanced 
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Measurement Approaches according to the new Basel accord: these are the Internal 
Measurement Approach (IMA), the Loss Distribution Approach (LDA), and the 
Scorecard Approaches. As an example, the analysis of the Basel-node Retail 
Banking/ External Fraud is demonstrated here. 

[0391] 3.1 . Data Analysis 

[0392] First, the historical loss data for a specified time frame will be roughly 
analyzed. This shows the quantiles, the mean and some distributional behavior. The 
quantile plot with the lognormal distribution shows the fit with that distribution, 
whereas the mean excess plot shows the tail behavior. 

[0393] Specifically, for the Basel node 'Retail Banking - External Fraud' one sees 
that for low loss amounts the lognormal fit is quite good, but deviating for high 
amounts. The tail is slightly smaller than the lognormal tail. See Figure 14. 

[0394] 3.2. The Expert Estimate 
[0395] **** Go to 'Expert Estimation' **** 

[0396] Especially when the historical loss data is scarce, it will be crucial to use 
the experience of subject matter experts. On the basis of their deep insight, they will 
estimate the frequency of certain loss events. The screen for entering the expert 
estimate has the following appearance. 

[0397] **** Enter expert weight, severity ranges and expected frequencies. Then 
click 'Run' **** See Figure 15. 

[0398] 3.3. The Internal Measurement Approach (IMA) 
[0399] ****Goto'IMA'**** 
[0400] **** Click 'Run' **** 

[0401] The IMA is the most elementary of the various Advanced Measurement 
Approaches in the Basel ll-accord. The expected loss is computed on the basis of 
historical loss data. The regulator will stipulate the Gamma-factors which will then be 
used to compute the corresponding operational risk charge. The IMA-screen looks 
as follows at Figure 16. 

[0402] Using the LDA-results, one can estimate the Gamma-factors. 

[0403] Under very weak distribution assumptions, one can give rough estimates 

for the 99.9% -quantiles. 

-58- 



-59- 

[0404] Chebychev's inequality: Assumption is finite variance 

[0405] Vysochanskii-Petunin-inequality: Assumption is finite variance and 

unimodality (i.e., only one maximum) 

[0406] Insurances cannot change the expected loss — they only change the 
variance of the loss distribution which will eventually impact the Gamma-factors. In 
such cases, the bank needs to demonstrate that its particular portfolio is significantly 
different from industry standards and thus adaptations of the Gamma-factors are 
justified. 

[0407] 3.4. Insurances 

[0408] The details of block 98 of Figure 3 are described here in the following text 
along with additional descriptions in other parts of the text. 
[0409] **** Go to Insurance Settings' **** 

[0410] **** Insert the example insurance of type 1 (individual insurance cover as 
external fraud is a seldom event) **** See Figure 17. 
[041 1] For the mitigation of negative impacts of operational loss events, 
insurances are widely used. Depending on the type of insurance, one will observe 
different behaviors of the corresponding loss distributions. The two main insurance 
types under consideration are the individual insurance covering every loss event 
separately, and the collective insurance covering the collective loss of certain event 
types. The first type can be typically found for low frequency/high severity loss 
events such as catastrophic events, whereas the latter one applies to frequent loss 
events with low severities. 

[0412] In the Quantification Tool, the user can specify the type of insurance and 
the range of insurance cover. 

[0413] At this point, an example is given for the different insurance types. The 
policy could, for example, cover external fraud in retail banking up to an amount of 1 
Mio EUR. Thus, every time such an event occurs, the insurance applies and reduces 
the loss amount by 1 Mio EUR. 

[0414] An example for the second type of insurance would be an insurance for 
the event of server down time. These events are certainly not catastrophic by 
themselves but can cause considerable damage when they occur too frequently. 
Here a policy could cover aggregated losses due to down time up to a total amount 
of 1 Mio EUR a year. Thus, only exceeding losses would not be covered by that 
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[0415] 3.5. The Loss Distribution Approach (LDA) 

[0416] Significantly more sophisticated than the IMA is the LDA. It is a genuine 
statistical analysis of historical loss data leading to a loss distribution. This 
distribution contains valuable information and can be used in manifold ways to obtain 
a good understanding of the specific operational risk exposure. 
[0417] This part of the risk assessment consists of three screens: one for 
determining the frequency distribution, one for determining the severity distribution 
and one where the loss distribution is computed. 
[0418] **** Go to 'LDA Frequency' **** 
[0419] **** Click 'Run 1 **** 

[0420] Possible parametric distributions for the frequency are Poisson and 
negative binomial. 

[0421] The programme performs an overdispersion test and suggests the use of 
a negative binomial distribution (2 parameters) for modeling the frequency. 
[0422] **** Choose 'Negative Binomial' as the preferred frequency distribution **** 
See Figure 18. 

[0423] **** Go to 'LDA Severity Prep.' **** 
[0424] **** Click the left 'Run'-button **** 

[0425] Looking at the Hill plot, one can see that the stable region for the tail 
parameters ends at 3 / 4. 

[0426] **** Choose '4' as the parameter k; click the right 'Run'-button **** 

[0427] Note that the Hill plot of the tail shows a good fit. See Figure 1 9. 

[0428] **** Go to 'LDA Results' and click the 'Run'-button **** 

[0429] The screen with the results is shown at Figure 20. 

[0430] One clearly sees the difference between the loss distribution functions 

depending on whether or not insurance cover has been considered. For a better 

understanding of the tail behavior, various quantiles are reported. 

[0431] 3.6. The Scorecards Approaches 

[0432] The Scorecard approach marries the historical information obtained from 
loss data and forecast, respectively, expert information coming from internal risk 
assessment systems such as internal ratings. 
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[0433] In the present version of the Quantification Tool, two different scorecard 
approaches on the basis of loss distributions are implemented: one uses regression 
with internal rating information, the other incorporates the additional information via a 
Bayes transformation process. Common to all scorecard approaches is the 
challenge to merge information from completely different sources and with different 
data structure such as loss data on the one side and expert insight on the other side. 
The difficulty here is to ensure a consistent data structure in order to perform a high- 
quality risk assessment. The remarkable advantage of these approaches is the fact 
that quantitative as well as qualitative data is taken into consideration to form an 
overall risk assessment of an analysis unit. 



[0434] 3.6.1 . The Scorecard Approach with Regression 

[0435] **** Go to 'SCA Regression Settings' **** 

[0436] **** Insert Rating Information **** 

[0437] **** Click 'Run' **** See Figure 21 . 

[0438] **** Go to 'SCA Regression Results' **** 

[0439] **** Click 'Run' **** 

[0440] Accordingly, one has the following screen of results as shown at Figure 
22. 



[0441] 3.6.2. The Scorecard Approach with Bayes Transformation 

[0442] **** Go to 'SCA Bayes Settings' **** 

[0443] **** Click 'Run' **** 

[0444] **** Enter Updating mean to be '1.9'; then choose Negative Binomial 

Distribution' **** See Figure 23. 

[0445] **** Go to 'SCA Bayes results' **** 

[0446] **** Click 'Run' **** See Figure 24. 

[0447] 3.7. Sensitivity Analysis 

[0448] The details of block 82 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 
[0449] **** Go to 'Sensitivity Analysis' **** 

[0450] **** Enter ranges for the mean and for the tail parameter; then click 'Run' 
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[0451] In order to obtain a proper understanding of the sensitivities of the 
operational risk situations, certain analyses are performed accordingly. These are, in 
particular, the sensitivities for the frequency mean and for the tail parameter of the 
severity. See Figure 25. 

[0452] After the complete analysis of the unit, the user needs to decide for one 
loss distribution, which will be used for that unit in the further assessment process. 

[0453] 3.8. Selection of Results 

[0454] The details of biock 72, 78 of Figure 2 are described here in the following 
text along with additional descriptions in other parts of the text. 
[0455] **** Go to 'Select Distribution 5 **** 

[0456] After the complete analysis of the unit, the user needs to decide for one 
loss distribution which will be used for that unit in the further assessment process. 
See Figure 26. See also block 310 of Figure 42. 
[0457] **** Go back to 'Main Form' **** 

[0458] **** Click on 'Calculation Progress' to show which Analysis units are 
evaluated **** 

[0459] **** Go back to 'Main Form' **** 



[0460] 4. Definition of Aggregation Tree and Reporting 

[0461] The details of block 84 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 
[0462] **** Click on 'Setup Aggregation Tree' **** 

[0463] After the analysis of all analysis units, an aggregation tree has to be 
specified. This structure contains all relevant aggregation results for a 
comprehensive risk assessment. In the example, one is firstly interested in 
aggregating to the units Investment Banking - External Fraud, Banking - External 
Fraud and Others — External Fraud. In the second aggregation step, one obtains an 
overview of the overall losses due to external fraud. 

[0464] **** Click on 'External Fraud - Investment Banking', then on 'External 
Fraud - Banking', and finally on 'External Fraud - Others' to show the content of the 
first aggregation level **** See Figure 27. 

[0465] **** Change Aggregation level from 'Level T to 'Level 6', and click on 
'External Fraud -total' **** See Figure 28. 
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[0466] The aggregation tree for this specific situation would be as follows at 
Figure 29. 

[0467] **** Go back to 'Main Form' **** 

[0468] The reporting of the analysis results is done according to the previously 
defined aggregation tree. Thus, one obtains operational risk assessments for all 
analysis units and additional aggregations. 

[0469] The details of block 86 and 88 of Figure 2 and block 100 of Figure 3 are 
described here in the following text along with additional descriptions in other parts of 
the text. 

[0470] **** Click on 'Save Report of all evaluated AUs', and specify name and 
path **** 

[0471] **** Click on 'Save the Report of all Aggregations 1 , and specify name and 
path **** 

[0472] In the present version of the Quantification Tool, total positive dependence 
between different analysis units is assumed. This allows adding the respective 
quantiles of the loss distribution to obtain the corresponding quantile of the 
aggregation. In practice, this will generally overestimate the actual risk exposure, 
and thus lead to a higher operational risk charge. The best overview about the 
aggregation procedure gives the following screens. 
[0473] **** Open the saved reports **** 
[0474] The Analysis Units. See Figure 30. 
[0475] The Aggregations. See Figures 31-34. 
[0476] **** Close reports **** 

[0477] Using the Quantification-Tool for Operational Risks 

[0478] 1. Introduction 

[0479] This section describes how the quantification tool for operational risk can 
be used for risk assessments of a typical and specific analysis requirement of a user 
of the tool. Figure 12 shows the first screen display of another version of the 
quantification tool. Many of the screen displays of the following version are the same 
or similar to the screen displays from the previously described version; therefore, the 
same screen displays are referred to where the screens are similar in order to avoid 
needless duplication. 

[0480] The Quantification Tool covers all Advanced Measurement Approaches 
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The Internal Measurement Approach (IMA) 
The Loss Distribution Approach (LDA) 
The Scorecard Approaches 

o Scorecard Approach on LDA-basis using internal rating regression 
o Scorecard Approach on LDA-basis using Bayes-update. 

[0481] 2. Inclusion of External Loss Data 

[0482] The details of blocks 70 and 76 of Figure 2 and blocks 90, 92 and 94 of 
Figure 3 are described here in the following text along with additional descriptions in 
other parts of the text. 

[0483] A central issue in the assessment of operational risks is the inclusion of 
external loss data - especially for rare events with high impacts. 

[0484] 2.1 . The Conventional Method 

[0485] The quantification tool supports the integration of external loss data as it is 
conventionally done: i.e. the loss frequency regarded as internal, while the loss amount is 
adjusted to reflect the particular circumstances of the individual bank. See Figure 35. 

[0486] 2.2. Integration on the Basis of Check Points 

[0487] The quantification tool also supports an alternative way of including external 
loss data for the augmentation of the statistical basis for the risk assessment. The loss 
amounts are not changed in general - there is only a cut-off function reflecting roughly 
the size of the business. The inclusion procedure works on the basis of so called check 
points. These are internal control mechanisms which could prevent a particular loss 
event from occurring internally. The reliability of the check points is assessed and used 
for adjusting the event frequency to internal conditions. See Figure 36. 

[0488] 3. Data Structure and Definition of Analysis Units 

[0489] The details of block 72 of Figure 2 and blocks 96 and 98 of Figure 3 are 

described here in the following text along with additional descriptions in other parts of the 

text. 

[0490] The loss data is organized along four dimensions: business lines, event types, 
organizational units and processes, i.e. every loss event has these four attributes and 
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aggregation logic can move across those four dimensions. The first two correspond to 
the preliminary Basel II data structure. The 'Organizational unit' and Processes' attribute 
are used to describe the allocation of the loss to an internal part of the bank's business 
model. There might be more necessary attributes. However, for data scarcity reasons, a 
certain abstraction discipline is enforced within this tool, as it cannot be expected that 
there will be enough data to populate more than the resulting analysis nodes for these 
four dimensions. 

[0491] In the present example there are 896 elementary nodes, depicting the Basel II 
nodes plus a very basic structure of organizational units and internal 'processes'. 
[0492] An analysis unit summarizes loss data and forms the most elementary 
analysis level. Although the user is free in the definition of analysis units, it is 
recommended to define analysis units to be completely contained within one Basel II- 
node to ensure data consistency for a valid statistical analysis. 
[0493] For the sake of simplicity, the Basel ll-nodes are already pre-defined as 
possible analysis units. See Figure 37. 

[0494] For the example 'external fraud assessment', one may consider only the 
dimensions Basel Business Lines and Event Types. Thus, one may aggregate the 896 
elementary nodes into analysis units, which form 'Basel-nodes'. This gives eight Basel- 
analysis units: external fraud across all eight business lines. 

[0495] 4. Evaluating an Analysis Unit 

[0496] After defining the aggregation-structure, the risk assessment for the analysis 
units has to be performed. The Quantification Tool covers all Advanced Measurement 
Approaches according to the new Basel-accord: these are the Internal Measurement 
Approach (IMA), the Loss Distribution Approach (LDA), and the Scorecard Approaches. 
[0497] As an example, the analysis of the Basel-node Retail Banking/External Fraud 
is demonstrated here. 

[0498] 4.1. Data Analysis 

[0499] First, the historical loss data for a specified period will be roughly analyzed. 
This shows the quantiles, the mean and some distributional behavior. The quantile plot 
with the lognormal distribution shows the fit with that distribution, whereas the mean 
excess plot shows the tail behavior. 

[0500] Specifically, for the Basel node 'Retail Banking - External Fraud' one sees 
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that for low loss amounts the lognormal fit is quite good, but deviating for high 
amounts. The tail is slightly smaller than the lognormal tail. See Figure 14. 

[0501] 4.2. The Expert Estimate 

[0502] Especially when the historical loss data is scarce, it will be crucial to use 
the experience of subject matter experts. Because of their deep insight, they will 
estimate the frequency of certain loss events. The screen for entering the expert 
estimate has the following appearance. See Figure 15. 

[0503] 4.3. The Internal Measurement Approach (IMA) 
[0504] The IMA is the most elementary of the various Advanced Measurement 
Approaches in the Basel ll-accord. The expected loss is computed based on 
historical loss data. The regulator will stipulate the Gamma-factors, which will then 
be used to compute the corresponding operational risk charge. The IMA-screen 
looks as follows at Figure 16. 

[0505] Using the LDA-results, one can estimate the Gamma-factors. 

[0506] Under very weak distribution assumptions, one can give rough estimates 

for the 99.9%-quantiles. 

o Chebychev's inequality: Assumption is finite variance 
o Vysochanskii-Petunin-inequality: Assumption is finite variance and 
unimodality (i.e. only one maximum) 
[0507] Insurances cannot change the expected loss - they only change the 
variance of the loss distribution, which will eventually influence the Gamma-factors. 
In such cases, the bank needs to demonstrate that its particular portfolio is 
significantly different from industry standards and thus adaptations of the Gamma- 
factors are justified. 

[0508] 4.4. Insurances 

[0509] The details of block 98 of Figure 3 are described here in the following text 
along with additional descriptions in other parts of the text. 
[0510] For the mitigation of negative impacts of operational loss events, 
insurances are widely used. Depending on the type of insurance, one will observe 
different behaviors of the corresponding loss distributions. The two main insurance 
types under consideration are the individual insurance covering every loss event 
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separately, and the collective insurance covering the collective loss of certain event 
types. The first type can be typically found for low frequency/high severity loss 
events such as catastrophic events, whereas the latter one applies to frequent loss 
events with low severities. 

[0511] In the Quantification Tool, the user can specify the type of insurance and 
the range of insurance cover. See Figure 17. 

[0512] At this point, examples are given for the different insurance types. The 
policy could for example cover external fraud in retail banking up to an amount of 1 
Mio EUR. Thus, every time such an event occurs the insurance applies and reduces 
the loss amount by 1 Mio EUR. 

[0513] An example for the second type of insurance would be an insurance for 
the event of server down time. These events are certainly not catastrophic by 
themselves but can cause considerable damage when they occur too frequently. 
Here a policy could cover aggregated losses due to down time up to a total amount 
of 1 Mio EUR a year. Thus, only exceeding losses would not be covered by that 
insurance. 

[0514] 4.5. The Loss Distribution Approach (LDA) 

[0515] Significantly more sophisticated than the IMA is the LDA. It is a genuine 

statistical analysis of historical loss data leading to a loss distribution. This 

distribution contains valuable information and can be used in manifold ways to obtain 

a good understanding of the specific operational risk exposure. 

[051 6] This part of the risk assessment consists of three screens: one for 

determining the frequency distribution, one for the determining the severity 

distribution and one where the loss distribution is computed. 

[0517] Possible parametric distributions for the frequency are Poisson and 

negative binomial. 

[0518] The program performs an overdispersion test and suggests the use of a 
negative binomial distribution (2 parameters) for modeling the frequency. See Figure 
18. 

[0519] Looking at the Hill plot, one sees that the stable region for the tail 
parameters ends at 3 / 4. (Note that the Hill plot of the tail shows a good fit.) See 
Figure 19. 

[0520] The screen with the results is shown at Figure 20. 
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[0521] One clearly sees the difference between the loss distribution functions 
depending on whether or not insurance cover has been considered. For a better 
understanding of the tail behavior, various quantiles are reported. 

[0522] 4.6. The Scorecards Approaches 

[0523] The Scorecard approach marries the historical information obtained from 
loss data and forecast respectively expert information coming from internal risk 
assessment systems such as internal ratings. 

[0524] In the present version of the Quantification Tool two different scorecard 
approaches on the basis of loss distributions are implemented: one uses regression 
with internal rating information, the other incorporates the additional information via a 
Bayes transformation process. Common to all scorecard approaches is the 
challenge to merge information from completely different sources and with different 
data structure such as loss data on the one side and expert insight on the other side. 
The difficulty here is to ensure a consistent data structure in order to perform a high- 
quality risk assessment. The remarkable advantage of these approaches is that 
both, quantitative as well as qualitative data is taken into consideration to form an 
overall risk assessment of an analysis unit. 

[0525] 4.6.1. The Scorecard Approach with Regression 

[0526] On the basis of these internal ratings one can deduce updates for the IMA 
or the LDA. See Figure 21 . Thus one has the following screens of results for the 
scorecard approach with regression. 

[0527] Scorecard approach with regression on IMA basis. See Figure 38. 
[0528] Scorecard approach with regression on LDA basis. See Figure 39. 

[0529] 4.6.2. The Scorecard Approach with Bayes Transformation 

[0530] Within the screen shown at Figure 23, one may enter an update to the 

mean information (e.g. to be '1,9') and choose a distribution (e.g. 'Negative Binomial 

Distribution'). 

[0531] The above selection turns into the following results on the 'SCA Bayes results' 
tab as shown at Figure 40. 

[0532] 4.7. Sensitivity Analysis 
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[0533] The details of block 82 of Figure 2 are described here in the following text 
along with additional descriptions in other parts of the text. 

[0534] In order to obtain a proper understanding of the sensitivities of the operational 
risk situations, certain analyses are performed accordingly. These are in particular the 
sensitivities for the frequency mean and for the tail parameter of the severity. See Figure 
25. 

[0535] After the complete analysis of the unit, the user needs to decide for one loss 
distribution, which will be used for that unit in the further assessment process. 

[0536] 4.8. Selection of Results 

[0537] The details of blocks 72 and 78 of Figure 2 are described here in the following 
text along with additional descriptions in other parts of the text. 

[0538] After the complete analysis of the unit, the user needs to decide for one loss 
distribution, which will be used for that unit in the further assessment process. See Figure 
26. See also block 310 of Figure 42. 

[0539] 5. Definition of Aggregation Tree and Reporting 

[0540] The details of block 84 of Figure 2 are described here in the following text 

along with additional descriptions in other parts of the text. 

[0541] After the analysis of all analysis units, an aggregation tree has to be specified. 
This structure contains all relevant aggregation results for a comprehensive risk 
assessment. In this example, one is firstly interested in aggregating to the units 
Investment Banking - External Fraud, Banking - External Fraud and Others - External 
Fraud. In the second aggregation step, one obtains an overview of the overall losses due 
to external fraud. See Figures 27-28. 

[0542] The aggregation tree for this specific situation would be as follows at Figure 
29. 

[0543] The reporting of the analysis results is done according to the previously 
defined aggregation tree. Thus, one obtains operational risk assessments for all analysis 
units and additional aggregations. 

[0544] The details of blocks 86 and 88 of Figure 2 and block 1 00 of Figure 3 are 
described here in the following text along with additional descriptions in other parts of the 
text. 

[0545] In the present version of the Quantification Tool, total positive dependence 
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between different analysis units is assumed. This allows adding the respective quantiles 
of the loss distribution to obtain the corresponding quantile of the aggregation. In 
practice, this will generally overestimate the actual risk exposure, and thus lead to a 
higher operational risk charge. The following screens provide the best overview about the 
aggregation procedure. 

[0546] Overview on the Aggregation Units. See Figure 41 . 
[0547] The Analysis Units. See Figure 30. 
[0548] The Aggregations. See Figures 31-34. 

[0549] While a preferred embodiment of the invention has been described, it 
should be understood that the invention is not so limited, and modifications may be 
made without departing from the invention. The scope of the invention is defined by 
the appended claims, and all embodiments that come within the meaning of the 
claims, either literally or by equivalence, are intended to be embraced therein. 
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